Getting Data In

Universal forwarder is not reading all the files/directories from the monitored directories in inputs.conf


Hi Splunkers ,


Our Architectures  has 3 universal forwarders running in cluster . There is a load balancer running in front of UF where all the source  send logs via load balancer. Load balancer distributes data to  any of the of the 3 UF's based on load.


We notice that that UF is not able to read all the sub directories. 

Please help in troubleshooting.

Thanks in Advance

Labels (1)
Tags (1)
0 Karma


That architecture sounds unusual.  Please tell us more about it.  What data is being sent to the UFs?  Why is there a load balancer in front of the UFs?

Universal Forwarders usually read data from local files and send it to Splunk indexers.  In that scenario, there is no place for a load balancer.

Perhaps your UFs are reading data from TCP ports and you are using the load balancer to distribute data among the UFs.  But then the remark "not able to read all the sub directories" doesn't make sense to me.

Please tell us more about your problem.

If this reply helps you, an upvote would be appreciated.
0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!