Getting Data In
Highlighted

SplunkUniversalForwarder not forwarding input files

Path Finder

We are using SplunkUniversalForwarder 4.2.3 x64 to forward some logs. inputs.conf has the following stanzas

[monitor://D:\Program Files (x86)\MicroStrategy\Web Logs\CustomMSTRLog*]
disabled = 0
sourcetype = stgmstresm_log
crcSalt =

[WinEventLog:Application]
disabled = 0

[WinEventLog:System]
disabled = 0

Eventlogs are getting forwarded without any issues but the apache logs are not. I am not seeing any errors in splunkd.log on the forwarder.

0 Karma
Highlighted

Re: SplunkUniversalForwarder not forwarding input files

SplunkTrust
SplunkTrust

Hi anaptshah

there are many things, that could prevent a file from being read by the universal forwarder:

  • file permission: does the user/service account which runs the splunkd have read access to this file?
  • typo in the stanza: does splunkd.exe list monitor show your stanza with the correct path?
  • maybe the file just does not get changed?
  • did you restart your universal forwarder? it happened to me sometimes, that after the restart the file gets immediately read by splunk

hope this helps a bit and you get it fixed.

cheers

Highlighted

Re: SplunkUniversalForwarder not forwarding input files

Path Finder

I uploaded the incorrect stanza, the stanza thats not working is as follows

[monitor://D:\Program Files (x86)\MicroStrategy\Web Logs\CustomMSTRLog*]
disabled = 0
sourcetype = stgmstresm_log
crcSalt =

splunkd.exe list monitor shows the directory but does not show any of the files. Is there something special about (x86)? The stanza on the original post works fine.

0 Karma
Highlighted

Re: SplunkUniversalForwarder not forwarding input files

Path Finder

I was able to resolve the issue using a whitelist. I think the wild card does not work because (x86) in the path.

[monitor://D:\Program Files (x86)\MicroStrategy\Web Logs]
whitelist = Custom[^/]*.log$
disabled = 0
sourcetype = stgmstresm_log
crcSalt =

View solution in original post

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.