Getting Data In

Why am I unable to send internal logs after enabling a Splunk forwarder?

cwl
Contributor

Splunk forwarders seem to stop forwarding internal logs after enabling SplunkForwarder app.

Any idea how to forward internal logs even after enabling Splunk forwarder?

0 Karma
1 Solution

cwl
Contributor

Current issue is being caused by forwardedindex.2.whitelist parameter in SPLUNK_HOME/etc/apps/SplunkForwarder/default/outputs.conf

[tcpout] 
... 
forwardedindex.2.whitelist = (_audit|_introspection|_telemetry) 
... 

Please add below content to either in SPLUNK_HOME/etc/apps/SplunkForwarder/local/outputs.conf or SPLUNK_HOME/etc/system/local/outputs.conf to fix this issue.

[tcpout] 
forwardedindex.2.whitelist = (_audit|_internal|_introspection|_telemetry) 

View solution in original post

0 Karma

cwl
Contributor

Current issue is being caused by forwardedindex.2.whitelist parameter in SPLUNK_HOME/etc/apps/SplunkForwarder/default/outputs.conf

[tcpout] 
... 
forwardedindex.2.whitelist = (_audit|_introspection|_telemetry) 
... 

Please add below content to either in SPLUNK_HOME/etc/apps/SplunkForwarder/local/outputs.conf or SPLUNK_HOME/etc/system/local/outputs.conf to fix this issue.

[tcpout] 
forwardedindex.2.whitelist = (_audit|_internal|_introspection|_telemetry) 
0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...