Getting Data In

Universal forwarder is not reading all the files/directories from the monitored directories in inputs.conf


Hi Splunkers ,


Our Architectures  has 3 universal forwarders running in cluster . There is a load balancer running in front of UF where all the source  send logs via load balancer. Load balancer distributes data to  any of the of the 3 UF's based on load.


We notice that that UF is not able to read all the sub directories. 

Please help in troubleshooting.

Thanks in Advance

Labels (1)
Tags (1)
0 Karma


That architecture sounds unusual.  Please tell us more about it.  What data is being sent to the UFs?  Why is there a load balancer in front of the UFs?

Universal Forwarders usually read data from local files and send it to Splunk indexers.  In that scenario, there is no place for a load balancer.

Perhaps your UFs are reading data from TCP ports and you are using the load balancer to distribute data among the UFs.  But then the remark "not able to read all the sub directories" doesn't make sense to me.

Please tell us more about your problem.

If this reply helps you, an upvote would be appreciated.
0 Karma
Get Updates on the Splunk Community!

About Time picker tokens

I would like to search from 600 seconds before to 600 seconds after the time specified in the time picker on ...

tag as datamodel attribute

I'm confused a bit. I use CIM datamodels.The "tag" field is both a filter for choosing events applicable to a ...

Running multiple macros in the same search

Hi all!I'm trying to run multiple macros in the same search and eventually aggregate the results from each ...