Getting Data In

Why can I not see logs in splunk

blbr123
Path Finder

Hi All,

I got a request to monitor a log files in splunk.

below are the log file name pattern:

abc_uat_cpe_220614.log

abc_dev_cpe_220615.log

abc_train_cpe_220616.log and so on..

I have configured inputs lik shown below:

[monitor:///usr/local/bsl_export/abc_*_cpe_*.log]

index=abdxj

sourcetype=bsl_export:cpe

disabled = 0

But i am not getting any logs in splunk checked all the things mentioned below:

Splunk service is running

spunk user had read access

Firewall connections are all good

has latest logs files with enough size to read

Restarted the splunk service still same issue, 

Checked _internal logs under log_level=WARN i see below message:

AutoloadBalancedConnectstrategy - Cooked connection to ip timed out

But connection is fine as i have checked it already.

When i run the below command it gives output as "hangup"

splunk list inputstatus

props is as below:

###########

JIRA link

###########

[bsl_export:cpe]

############

Can anyone please help me on this?

 

 

Tags (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @blbr123,

Then you have to perform some checks:

at first  did you already enabled logs receiving in your Indexers?

did you configured log forwarding in you Forwarders (outputs.conf)?

If not, please see https://docs.splunk.com/Documentation/Splunk/9.0.0/Data/Usingforwardingagents 

Then check the connection using from the Forwarder

telnet ip_Indexer 9997

if you haven't results there's a network problem.

Then check if you're receiving logs from the Forwarder, running on you Search head the search: 

index=_internal host=<your_host>

If you have results, there's a problem in your input, if not there's a network problem.

Here you can find some additional information https://docs.splunk.com/Documentation/Forwarder/9.0.0/Forwarder/Troubleshoottheuniversalforwarder

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...

SignalFlow: What? Why? How?

What is SignalFlow? Splunk Observability Cloud’s analytics engine, SignalFlow, opens up a world of in-depth ...

Federated Search for Amazon S3 | Key Use Cases to Streamline Compliance Workflows

Modern business operations are supported by data compliance. As regulations evolve, organizations must ...