Why is Splunk not receiving logs?

[siva_cg]

Hi All,

We have manifest logs configured to Splunk from different application servers. Due to duplicate stanzas, we didn't receive logs from few servers but after investigating we have removed the duplicate stanzas and deployed it again. But still we are receiving logs to Splunk. As the manifest logs are very small in size (in bytes) and will not update frequently, so we have added crcSalt attribute in the inputs.conf also but no luck.

I have run btool command on the universal forwarder, but there are no issues found. Could you please help me investigating the issue and resolve it?

The last event from that file is 20th April 2017. Thank you in advance.

[sbbadri · Accepted solution]

You can do below things,

1) Check UF is up and running
2) check outputs.conf is properly configured
3) check splunkd.log for errors
4) $SPLUNK_HOME$/bin/splunk list inputstatus - This command will give you log ingestion status.
5) Try putting ignoreOlderThan = 1d or your required time

[neermine]

hii in the inputs.conf i wrote [monitor://C:\var\log*.log] disabled = 0 sourcetype= log index=me

but when i tape the command splunk list inputstatus i find C:\var\log*.log type is missing what should i do ?

[siva_cg]

Thank you very much @sbbadri and @mmodestino. the command $SPLUNK_HOME$/bin/splunk list inputstatus helped me to investigate the issue. We have specified ignoreolderthan 7days attribute in the inputs.conf due to which we are not receiving logs.

[mattymo]

./splunk list inputstatus on the UF 4 ftw!

[latheefsk]

How to use ./splunk list input status by cmd