Getting Data In

Why are my UDP inputs not showing up in my metrics.log?

rene847
Path Finder

Hi all,

I would like to know....

I have a functional index named "phone"
I have 120 IP (with no host) defined in inputs.conf on Universal Forwarders with index=phone.

Example:

[udp://aaa.bbb.ccc.ddd:514]
        source = sip_syslog
        sourcetype = phone:siplab
        connection_host = none
        acceptFrom = aaa.bbb.ccc.ddd
        disabled = false
        index = phone

I find data with search on the search head with index=phone and my index on the server grows (so it's functional), but when I run this command (Highest-usage indexes), I don't have my Phone index. Why?

See my query:
index="_internal" source="*metrics.log" per_index_thruput | eval GB=kb/(1024*1024) | stats sum(GB) as total by series date_mday | sort total | fields + date_mday,series,total | reverse

However, with this query, I see my index:
index=_internal source=license_usage.log type=Usage | stats sum(b) by idx | sort sum(b) |reverse

I don't know why I don't have my index with the first query (made by Splunk)?

I would like just 1 report with ALL index for one day (first query). Do you have an idea?

Thanks in advance
Best Regards
Rene R.

0 Karma
1 Solution

tskinnerivsec
Contributor

is your index name all lower case ? index=phone, If not, it should be lower case, can cause problems if not.

View solution in original post

0 Karma

tskinnerivsec
Contributor

is your index name all lower case ? index=phone, If not, it should be lower case, can cause problems if not.

0 Karma

rene847
Path Finder

No, its correct.... it's a bad exemple
I corrected my post.

but my problem is still present !!!!!

0 Karma
Get Updates on the Splunk Community!

Introducing Ingest Actions: Filter, Mask, Route, Repeat

WATCH NOW Ingest Actions (IA) is the best new way to easily filter, mask and route your data in Splunk® ...

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...