Getting Data In

Universal Forwarder not sending monitor after installing Splunk App for Windows Infrastructure

tbrown
Path Finder

I installed the Splunk App for Windows Infrastructure using the following Splunk guide: https://docs.splunk.com/Documentation/MSApp/2.0.1/MSInfra/AbouttheSplunkAppforMSInfrastructure. I set up my the Splunk deployment server on my Splunk Enterprise Instance. For some reason, the Splunk Forwarder that I set up to be a client of this server is no longer sending the logs from the monitor that I defined in C:\Program FIles\SplunkUniversalForwarder\etc\apps\SplunkUniversalForwarder\local\inputs.conf. 

The Splunk Windows Add-on and the Splunk App for Windows Infrastructure is working correctly and is sending the Windows logs to the deployment server. 

I believe I need to change something in the setting of the deployment server/clients/server class to get my monitor to send the logs to the "main" index but I don't know what to change.

 

Labels (2)
0 Karma

anilchaithu
Builder

@tbrown 

This has nothing to do with the app.

Please check the below.

1) Can you please check whether the role that run splunkd has access to the data to be monitored.

2) Does the client is forwarding internal logs to the main splunk instance. index=_internal host="client"

3) Does the client communicating to the deployment server? settings -> forwarder management

4) if all the above checks out, please look for errors in the splunkd logs on the client .

 

 

0 Karma

tbrown
Path Finder

Some more information, when I do ./splunk list monitor on both the Splunk instance and the forwarder, the correct directories show up so they are recognized as inputs. I think the issue is therefore related to how I configured the "Universal Forwarders" server class or my clients in the deployment server.

0 Karma
Get Updates on the Splunk Community!

Database Performance Sidebar Panel Now on APM Database Query Performance & Service ...

We’ve streamlined the troubleshooting experience for database-related service issues by adding a database ...

IM Landing Page Filter - Now Available

We’ve added the capability for you to filter across the summary details on the main Infrastructure Monitoring ...

Dynamic Links from Alerts to IM Navigators - New in Observability Cloud

Splunk continues to improve the troubleshooting experience in Observability Cloud with this latest enhancement ...