Getting Data In

SC4S Debug mode directories / Why is function missing in version 2?

jomon_ng
Observer

we have added below line in the env_file, so that events will be catpured and ease to identifier the sourcetype.
SC4S_DEST_GLOBAL_ALTERNATES=d_hec_debug

In version version 1.110.0, we could see all the incoming sourcetype on it as below
$ ls
cisco_asa fortinet_fortios nix_syslog sc4s_events sc4s_fallback vmware_esx zscaler_web

But in version 2.0 till 2.28.0, we failed to see any sourcetype listed on it with same configuration in above,  the "debug" folder is not create even after restart the sever

[DEV][archive] $ ls
[DEV][archive] $ pwd
/apps/sc4s/archive


Any hints what the change in between the version 1 and version 2 that possible caused the debug mode failed? (events are showing in Splunk)
*we just do in place upgrade from version 1 to version 2 on same working servers. IF we moved back to version 1, the debug directories will showed agai

Labels (1)
Tags (1)
0 Karma
Get Updates on the Splunk Community!

How to Monitor Google Kubernetes Engine (GKE)

We’ve looked at how to integrate Kubernetes environments with Splunk Observability Cloud, but what about ...

Index This | How can you make 45 using only 4?

October 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Splunk Education Goes to Washington | Splunk GovSummit 2024

If you’re in the Washington, D.C. area, this is your opportunity to take your career and Splunk skills to the ...