I'm having an issue getting the data in my .log files into splunk. I've tested connections, there are no firewall issues and my list-forward returned Active, but not forwarding.
Logs are stored at /var/og/rsyslog/firewall.log
inputs.conf
[monitor:///var/log/rsyslog/firewall.log]
disabled=false
index=firewall
sourcetype=syslog
outputs.conf
[tcpout]
defaultgroup= indexer
autoLB=true
[tcpout=indexer]
disabled=false
server=x.x.x.20:9997
When I open my splunkd-utility.log, I get a WARN for UserManagerPro - can't [distributedSearch] stanza in distsearch.conf
There is no distsearch.conf file on this system that I can find. Is my error coming from a misconfigured inputs/outputs configuration, or lack of this missing file?
Dear Antifreke,
I usally setup the autoLB=True on the stanza where the indexer is being setup like this:
[tcpout]
defaultgroup= indexer
[tcpout=indexer]
disabled=false
server=x.x.x.20:9997
autoLB=true
For the most recent splunk universal forwarder versions, this parameter is no longer being used, it has been deprecated.
Please see this data below from outputs.conf
https://docs.splunk.com/Documentation/Splunk/6.6.2/Admin/Outputsconf#outputs.conf
autoLBFrequency =
* Every autoLBFrequency seconds, a new indexer is selected randomly from the
list of indexers provided in the server attribute of the target group
stanza.
* Defaults to 30 (seconds).
other tool that I am using to troubleshoot the config files is btool, please see here how you can use it
it is very hepfull and you can check for all the stanzas and parameters that was setup.
It can be something like:
./splunk cmd btool distsearch list --debug | more
If I am not wrong the distsearch.conf is created once you setup your indexers in your search head.
I hope this assist you to fix your issue.