Splunk UF Not reading logs.

[Prakash493]

Hi , I am in a situation now ,

My splunk Universal forwarder is sometimes sending the logs and sometimes its not sending the logs , i checked we have logs generated constantly on systems and checked the input path mentioned is correct. We didnt change anything last logs we got on july 1. Then we restarted couple of forwarders and reload the deployment server after some times 2 events came. Then next day no events and today on july 5 we received 5 events only which is way below. Sometimes its sending logs very few and sometimes not. I checked in internal index , splunkd logs i didnt find any error messages on splunkd logs. What might be the issue here ?

before july 1 everything was normal log ingestion inputs paths everything is same as today.

[woodcock · Accepted solution]

The most common reason for this is too many co-resident files in the same director(y|ies) as the files that you are forwarding. Typically the files are rotated and the rotated logs just hang out forever. You must not let this happen. At hundreds of files you will see great slowdown at thousands you will see complete standstill. It will be OK for a few minutes whenever you restart Splunk but it will immediately lockup. You have to get rid of those old files.

[Prakash493]

thanks for your answer , i removed all the old logs from the main directory and restarted the forwarder and the logs came up.