Why can I not see logs in splunk

[blbr123]

Hi All,

I got a request to monitor a log files in splunk.

below are the log file name pattern:

abc_uat_cpe_220614.log

abc_dev_cpe_220615.log

abc_train_cpe_220616.log and so on..

I have configured inputs lik shown below:

[monitor:///usr/local/bsl_export/abc_*_cpe_*.log]

index=abdxj

sourcetype=bsl_export:cpe

disabled = 0

But i am not getting any logs in splunk checked all the things mentioned below:

Splunk service is running

spunk user had read access

Firewall connections are all good

has latest logs files with enough size to read

Restarted the splunk service still same issue, 

Checked _internal logs under log_level=WARN i see below message:

AutoloadBalancedConnectstrategy - Cooked connection to ip timed out

But connection is fine as i have checked it already.

When i run the below command it gives output as "hangup"

splunk list inputstatus

props is as below:

###########

JIRA link

###########

[bsl_export:cpe]

############

Can anyone please help me on this?

[gcusello]

Hi @blbr123,

Then you have to perform some checks:

at first  did you already enabled logs receiving in your Indexers?

did you configured log forwarding in you Forwarders (outputs.conf)?

If not, please see https://docs.splunk.com/Documentation/Splunk/9.0.0/Data/Usingforwardingagents 

Then check the connection using from the Forwarder

telnet ip_Indexer 9997

if you haven't results there's a network problem.

Then check if you're receiving logs from the Forwarder, running on you Search head the search: 

index=_internal host=<your_host>

If you have results, there's a problem in your input, if not there's a network problem.

Here you can find some additional information https://docs.splunk.com/Documentation/Forwarder/9.0.0/Forwarder/Troubleshoottheuniversalforwarder

Ciao.

Giuseppe