Universal forwarder is not reading all the files/directories from the monitored directories in inputs.conf

[spl_unker]

Hi Splunkers ,

Our Architectures  has 3 universal forwarders running in cluster . There is a load balancer running in front of UF where all the source  send logs via load balancer. Load balancer distributes data to  any of the of the 3 UF's based on load.

We notice that that UF is not able to read all the sub directories. 

Please help in troubleshooting.

Thanks in Advance

[richgalloway]

That architecture sounds unusual.  Please tell us more about it.  What data is being sent to the UFs?  Why is there a load balancer in front of the UFs?

Universal Forwarders usually read data from local files and send it to Splunk indexers.  In that scenario, there is no place for a load balancer.

Perhaps your UFs are reading data from TCP ports and you are using the load balancer to distribute data among the UFs.  But then the remark "not able to read all the sub directories" doesn't make sense to me.

Please tell us more about your problem.