Hey everyone. I have written a simple forwarding app which monitors 2 directories. I have this app deployed on 2 servers currently, and everything works fine. All of the servers are built exactly the same, running the same vendor's software.
I tried installing it on a third server. The directories seem to be ignored. I checked with btool, everything is in inputs as it should be. It just isn't sending data. I have verified that there is data for it to send in the correct locations too. It just seems like splunk isn't forwarding that data. Is there any way to check possible reasons that it may not be forwarding? Or are there any things to look for?
Check to make sure you've configured your outputs.conf on the forwarder.
Also look at your splunkd.log for error messages, on both the forwarder and the indexer. It may be that you are actually sending data to the indexer, but your indexer isn't configured to deal with it yet. In which case you may want to confirm that the props.conf is properly configured.