Getting Data In

Splunk Universal forwarder Permission issue

ram254481493
Explorer

My splunk universal forwarder is not reading the logs from var/log directory , even not sending the splunkd logs to my search-head , This seems to me as a permission issue in first place , can any one help me out with the command or how can i tell my forwarder to read the logs from var/log directory ?

Tags (1)
0 Karma

nabeel652
Builder

Not being able to send splunkd logs is strange.

Have you tried the command

./splunk list forward-server (on linux)

splunk list forward-server (on Windows) under $SPLUNK_HOME/bin directory

0 Karma

marycordova
SplunkTrust
SplunkTrust

You are not even receiving the _internal splunk logs from the forwarder? Sounds more like a network layer issue than a permissions issue.

Check your network path, telnet or something, first.

Then, maybe remove the forwarder, re-install as root and check if you have logs. If you do then it's a permission issue. Remove the install as root, re-install as whatever user you want to use then make sure that user account is added to the group that can read the logs you want or make the logs readable by the user the forwarder is installed as.

At the very least you should be able to tail the splunkd.log file and check for any errors there.

@marycordova
0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...