Universal Forwarder doesn't forward specific log

[hohyuon]

Collect two logs with the Universal Forwarder.
One log is collected well, but one log is not collected.
Can you give me some advice on this phenomenon?

The input.conf configuration file.

[monitor://D:\Log\State\...\*.Log]
disabled = false
index = cds_STW112
sourcetype = mujin_CDS_IPA_Log_State
ignoreOlderThan = 1h

>>>>Not collecting

[monitor://D:\Log\Communication\DeviceNet\Input\...\*Input*.Log]
disabled = false
index = cds_STW112
sourcetype = mujin_CDS_DNetLog_IN
ignoreOlderThan = 1h

>>>>Collecting

[gcusello]

Hi @hohyuon ,

at first run the checks described by @deepakc that are the correct ones.

Then, please, check the timestamp format: if the forma is dd/mm/yyyy you have to define this format in props.conf

TIME_FORMAT = %d/%m/%Y %T:%M:$S

because Splunk, by default, uses te american format (mm/dd/yyyy) and during the first 12 days of the month doesn't assign the correct timestamp, so today it isn't correct and you don't see events with today's date, but tomorrow date.

Ciao.

Giuseppe

[deepakc · Accepted solution]

You can begin by checking with these commands as it looks like a Windows UF

#Shows monitored Files

\opt\splunkforwarder\bin\splunk list monitor

#Shows monitoried file inputs status

\opt\splunkforwarder\bin\splunk list inputstatus

Have you checked permissionss for the logs that are not being collected?

Have you checked the name of the paths/logs are correct (typos)?

Check splunkd.log - there may be some further info in there

\opt\splunkforwarder\var\log\splunk\splunkd.log
(Look for TailReader OR ERROR)

[hohyuon]

Thank you.
I solved it.

[gcusello]

Hi @hohyuon ,

good for you, see next time!

let us know if we can help you more, or, please, accept one answer for the other people of Community.

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated by all the contributors 😉