- Splunk Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- Re: Why a specific sourcetype is not forwarding on...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Why a specific sourcetype is not forwarding on a server while everything else is?
Permissions are there for the log file and no errors in the splunkd.log.
Everything seems to be working fine and everything is running as we can see that the data is forwarded at this moment. The only problem is that the specific data is not shown on the indexer, it was coming before but it stopped a few days ago.
What could be the problem?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Has this issue ever been resolved? I am facing a very similar issue.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Try running /opt/splunk/bin/splunk list monitor and see if your files/directory show up in there. Try searching splunkd.log from the forwarder with keyword as your file name (e.g. index=_internal sourcetype=splunkd host=YourHost *yourfilename*) and see if there are any warning of some sorts.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
index=_internal sourcetype=splunk host=YourHost yourfilename
where shd i run this sir ?? in forwarder or indexer ??
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
sourcetype=splunk or sourcetype=the sourcetype which is not getting forwarded
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I got it sir ,sorry for silly question! i wil run them and give u the results !
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello Sir , no errors of any sort !
what to do now
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Firstly, I had a typo in the search, just corrected it (sourcetype to be searched is splunk*d*).
Assuming your forwarder _internal logs from the forwarder to your indexers, this search should be run from your search head.
Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!
They're back! Join the SplunkTrust and MVP at .conf24
Enterprise Security Content Update (ESCU) | New Releases
