Getting Data In

SplunkUniversalForwarder not forwarding input files

anantshah
Path Finder

We are using SplunkUniversalForwarder 4.2.3 x64 to forward some logs. inputs.conf has the following stanzas

[monitor://D:\Program Files (x86)\MicroStrategy\Web Logs\CustomMSTRLog*]
disabled = 0
sourcetype = stg_mstr_esm_log
crcSalt =

[WinEventLog:Application]
disabled = 0

[WinEventLog:System]
disabled = 0

Eventlogs are getting forwarded without any issues but the apache logs are not. I am not seeing any errors in splunkd.log on the forwarder.

0 Karma
1 Solution

anantshah
Path Finder

I was able to resolve the issue using a whitelist. I think the wild card does not work because (x86) in the path.

[monitor://D:\Program Files (x86)\MicroStrategy\Web Logs]
whitelist = Custom[^/]*.log$
disabled = 0
sourcetype = stg_mstr_esm_log
crcSalt =

View solution in original post

0 Karma

anantshah
Path Finder

I was able to resolve the issue using a whitelist. I think the wild card does not work because (x86) in the path.

[monitor://D:\Program Files (x86)\MicroStrategy\Web Logs]
whitelist = Custom[^/]*.log$
disabled = 0
sourcetype = stg_mstr_esm_log
crcSalt =

0 Karma

MuS
Legend

Hi anaptshah

there are many things, that could prevent a file from being read by the universal forwarder:

  • file permission: does the user/service account which runs the splunkd have read access to this file?
  • typo in the stanza: does splunkd.exe list monitor show your stanza with the correct path?
  • maybe the file just does not get changed?
  • did you restart your universal forwarder? it happened to me sometimes, that after the restart the file gets immediately read by splunk

hope this helps a bit and you get it fixed.

cheers

anantshah
Path Finder

I uploaded the incorrect stanza, the stanza thats not working is as follows

[monitor://D:\Program Files (x86)\MicroStrategy\Web Logs\CustomMSTRLog*]
disabled = 0
sourcetype = stg_mstr_esm_log
crcSalt =

splunkd.exe list monitor shows the directory but does not show any of the files. Is there something special about (x86)? The stanza on the original post works fine.

0 Karma
Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...