Getting Data In

Why does the Universal Forwarder not forward files to the index or sourcetype configured in inputs.conf?

yoyu777
Explorer

Hi,

I've spent one day trouble-shooting this issue but still don't have any luck.

The files I want to forward are a pretty standard .csv with custom timestamps. So I created a sourcetype and an index for them.

Then I added this stanza in "~/etc/system/local/inputs.conf", monitoring a directory:

[monitor:///splunk-files/data_live/]
disabled = false
index = main
sourcetype = serv_req_final

But I noticed that the files are not correctly forwarded to the correct index and not parsed to the correct sourcetype. Instead, they are indexed by the "main" index and the sourcetype is "csv".

I've tried to restart forwarder instance and the Splunk enterprise instance, cleaned event data several times. But nothing worked... Also I tried to remove the monitor stanza, and the monitor was gone (proving that there's no other conflicting input configurations).

Has anyone ran into similar issues?
It is really frustrating because what I am trying to do is what I consider really basic..

0 Karma
1 Solution

FritzWittwer
Contributor

I'd try

$SPLUNK_HOME/bin/splunk btool --debug inputs list

it shows you what configuration the forwarder uses.

View solution in original post

FritzWittwer
Contributor

I'd try

$SPLUNK_HOME/bin/splunk btool --debug inputs list

it shows you what configuration the forwarder uses.

View solution in original post

Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.