Getting Data In

Why a specific sourcetype is not forwarding on a server while everything else is?

akhil36109
New Member

Permissions are there for the log file and no errors in the splunkd.log.
Everything seems to be working fine and everything is running as we can see that the data is forwarded at this moment. The only problem is that the specific data is not shown on the indexer, it was coming before but it stopped a few days ago.
What could be the problem?

0 Karma

kburtch
New Member

Has this issue ever been resolved?  I am facing a very similar issue.

0 Karma

isoutamo
SplunkTrust
SplunkTrust
Can you create a new question with proper and enough information, so we could better help you?
0 Karma

somesoni2
SplunkTrust
SplunkTrust

Try running /opt/splunk/bin/splunk list monitor and see if your files/directory show up in there. Try searching splunkd.log from the forwarder with keyword as your file name (e.g. index=_internal sourcetype=splunkd host=YourHost *yourfilename*) and see if there are any warning of some sorts.

0 Karma

akhil36109
New Member

index=_internal sourcetype=splunk host=YourHost yourfilename

where shd i run this sir ?? in forwarder or indexer ??

0 Karma

akhil36109
New Member

sourcetype=splunk or sourcetype=the sourcetype which is not getting forwarded

0 Karma

akhil36109
New Member

I got it sir ,sorry for silly question! i wil run them and give u the results !

0 Karma

akhil36109
New Member

Hello Sir , no errors of any sort !
what to do now

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Firstly, I had a typo in the search, just corrected it (sourcetype to be searched is splunk*d*).

Assuming your forwarder _internal logs from the forwarder to your indexers, this search should be run from your search head.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...