Getting Data In

Why am I unable to send internal logs after enabling a Splunk forwarder?

cwl
Contributor

Splunk forwarders seem to stop forwarding internal logs after enabling SplunkForwarder app.

Any idea how to forward internal logs even after enabling Splunk forwarder?

0 Karma
1 Solution

cwl
Contributor

Current issue is being caused by forwardedindex.2.whitelist parameter in SPLUNK_HOME/etc/apps/SplunkForwarder/default/outputs.conf

[tcpout] 
... 
forwardedindex.2.whitelist = (_audit|_introspection|_telemetry) 
... 

Please add below content to either in SPLUNK_HOME/etc/apps/SplunkForwarder/local/outputs.conf or SPLUNK_HOME/etc/system/local/outputs.conf to fix this issue.

[tcpout] 
forwardedindex.2.whitelist = (_audit|_internal|_introspection|_telemetry) 

View solution in original post

0 Karma

cwl
Contributor

Current issue is being caused by forwardedindex.2.whitelist parameter in SPLUNK_HOME/etc/apps/SplunkForwarder/default/outputs.conf

[tcpout] 
... 
forwardedindex.2.whitelist = (_audit|_introspection|_telemetry) 
... 

Please add below content to either in SPLUNK_HOME/etc/apps/SplunkForwarder/local/outputs.conf or SPLUNK_HOME/etc/system/local/outputs.conf to fix this issue.

[tcpout] 
forwardedindex.2.whitelist = (_audit|_internal|_introspection|_telemetry) 
0 Karma
Get Updates on the Splunk Community!

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...