I got a request to monitor a log files in splunk.
below are the log file name pattern:
abc_train_cpe_220616.log and so on..
I have configured inputs lik shown below:
disabled = 0
But i am not getting any logs in splunk checked all the things mentioned below:
Splunk service is running
spunk user had read access
Firewall connections are all good
has latest logs files with enough size to read
Restarted the splunk service still same issue,
Checked _internal logs under log_level=WARN i see below message:
AutoloadBalancedConnectstrategy - Cooked connection to ip timed out
But connection is fine as i have checked it already.
When i run the below command it gives output as "hangup"
splunk list inputstatus
props is as below:
Can anyone please help me on this?
Then you have to perform some checks:
at first did you already enabled logs receiving in your Indexers?
did you configured log forwarding in you Forwarders (outputs.conf)?
If not, please see https://docs.splunk.com/Documentation/Splunk/9.0.0/Data/Usingforwardingagents
Then check the connection using from the Forwarder
telnet ip_Indexer 9997
if you haven't results there's a network problem.
Then check if you're receiving logs from the Forwarder, running on you Search head the search:
If you have results, there's a problem in your input, if not there's a network problem.
Here you can find some additional information https://docs.splunk.com/Documentation/Forwarder/9.0.0/Forwarder/Troubleshoottheuniversalforwarder