Getting Data In

Why does the Universal Forwarder not forward files to the index or sourcetype configured in inputs.conf?

yoyu777
Explorer

Hi,

I've spent one day trouble-shooting this issue but still don't have any luck.

The files I want to forward are a pretty standard .csv with custom timestamps. So I created a sourcetype and an index for them.

Then I added this stanza in "~/etc/system/local/inputs.conf", monitoring a directory:

[monitor:///splunk-files/data_live/]
disabled = false
index = main
sourcetype = serv_req_final

But I noticed that the files are not correctly forwarded to the correct index and not parsed to the correct sourcetype. Instead, they are indexed by the "main" index and the sourcetype is "csv".

I've tried to restart forwarder instance and the Splunk enterprise instance, cleaned event data several times. But nothing worked... Also I tried to remove the monitor stanza, and the monitor was gone (proving that there's no other conflicting input configurations).

Has anyone ran into similar issues?
It is really frustrating because what I am trying to do is what I consider really basic..

0 Karma
1 Solution

FritzWittwer
Contributor

I'd try

$SPLUNK_HOME/bin/splunk btool --debug inputs list

it shows you what configuration the forwarder uses.

View solution in original post

FritzWittwer
Contributor

I'd try

$SPLUNK_HOME/bin/splunk btool --debug inputs list

it shows you what configuration the forwarder uses.

View solution in original post

.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!