Splunk forwarder not working

[vramali1]

Hello I couldnt see the log files indexed in splunk
Could you please help and mafdetlogindexer is the index name in the remote system.
Is it rightly configured and am i missing something?

Inputs.conf

[monitor:///ngs/app/coecmsd/shared/Cluster/logs/Latest_Log_8888.txt]
index=default
sourcetype=sendcsapplogs

Outputs.conf

[tcpout:mafdetlogindexer]
server = mafdet.corp.apple.com:8888
maxQueueSize = 500KB

Thanks,
-VIjay

[au_chrismor]

I hit something very similar sounding, where the receiver simple did not.

The only way around it was do remove the receiver, restart and re-add.

Cheers

[Damien_Dallimor]

Ensure that the receiver port on mafdet.corp.apple.com is configured to listen on 8888 (9997 is the default)

And try something like this in your config files:

inputs.conf

[monitor:///ngs/app/coecmsd/shared/Cluster/logs/Latest_Log_8888.txt] 
index=mafdetlogindexer 
sourcetype=sendcsapplogs
disabled = false

outputs.conf

[tcpout]
defaultGroup = mafdetlogindexer
disabled = false

[tcpout:mafdetlogindexer] 
server = mafdet.corp.apple.com:8888 
maxQueueSize = 500KB