Getting Data In

Why is a specific log file not getting forwarded when others in the same directory do?

BT_Neophyte
Explorer

I'm having an issue where a specific log file is not forwarding, but others in the same directory and Splunk app are forwarding.

The files in question are:
server.log
server.log.0

The .0 is just where the server.log rolls over to so I don't care about forwarding that as it is just stale and duplicate data. I have created an inputs.conf file for this directory and simplified it just monitor "server*".

My issue is that server.log.0 is showing up in Splunk whereas server.log is NOT. If I change the inputs .conf to specifically look for server.log then nothing shows up in Splunk.

Both files have the same owner and read/write permissions. What could be causing this? It seems like all variables are equal but I'm getting different results.

Here is the inputs.conf file in question:
[monitor:///api/logs/server.log]
sourcetype=serverapi_logs
index=api

[monitor:///api/logs/error.log]
sourcetype=errorrapi_logs
index=api

And an ls on the directory:
error.log error.log.0 README.md server.log server.log.0

0 Karma

masonmorales
Influencer

Try restarting your splunk forwarder to see if it picks up server.log. If that doesn't help, grep for server.log in $SPUNK_HOME/var/log/splunk/splunkd.log and see if there are any errors.

0 Karma

masonmorales
Influencer

Could you post your inputs.conf please?

0 Karma

BT_Neophyte
Explorer

Added more info above

0 Karma

juvetm
Communicator

were you Specify the new source type in forwarder inputs

0 Karma

juvetm
Communicator

the problem is not the permission

0 Karma
Get Updates on the Splunk Community!

Updated Team Landing Page in Splunk Observability

We’re making some changes to the team landing page in Splunk Observability, based on your feedback. The ...

New! Splunk Observability Search Enhancements for Splunk APM Services/Traces and ...

Regardless of where you are in Splunk Observability, you can search for relevant APM targets including service ...

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...