Getting Data In

Why can I not see logs in splunk

blbr123
Path Finder

Hi All,

I got a request to monitor a log files in splunk.

below are the log file name pattern:

abc_uat_cpe_220614.log

abc_dev_cpe_220615.log

abc_train_cpe_220616.log and so on..

I have configured inputs lik shown below:

[monitor:///usr/local/bsl_export/abc_*_cpe_*.log]

index=abdxj

sourcetype=bsl_export:cpe

disabled = 0

But i am not getting any logs in splunk checked all the things mentioned below:

Splunk service is running

spunk user had read access

Firewall connections are all good

has latest logs files with enough size to read

Restarted the splunk service still same issue, 

Checked _internal logs under log_level=WARN i see below message:

AutoloadBalancedConnectstrategy - Cooked connection to ip timed out

But connection is fine as i have checked it already.

When i run the below command it gives output as "hangup"

splunk list inputstatus

props is as below:

###########

JIRA link

###########

[bsl_export:cpe]

############

Can anyone please help me on this?

 

 

Tags (1)
0 Karma

gcusello
Esteemed Legend

Hi @blbr123,

Then you have to perform some checks:

at first  did you already enabled logs receiving in your Indexers?

did you configured log forwarding in you Forwarders (outputs.conf)?

If not, please see https://docs.splunk.com/Documentation/Splunk/9.0.0/Data/Usingforwardingagents 

Then check the connection using from the Forwarder

telnet ip_Indexer 9997

if you haven't results there's a network problem.

Then check if you're receiving logs from the Forwarder, running on you Search head the search: 

index=_internal host=<your_host>

If you have results, there's a problem in your input, if not there's a network problem.

Here you can find some additional information https://docs.splunk.com/Documentation/Forwarder/9.0.0/Forwarder/Troubleshoottheuniversalforwarder

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...