Why is my Splunk forwarder not sending data for all logs to indexer?

[baujla]

I have a forwarder installed on Linux server and 3 logfiles are configured to send data.

But only one or two logs are sending the data to index. If I disable the one log so that no data goes to that log, then the other two logs work and sends data. When all three are enabled, then one or two logs stop sending data to index.

How many logs can be configured in the forwarder's inputs.conf file? There is about 30 KB data coming per minute from each of these logs.

[jkat54]

Yeah remove host name from each of your input stanzas and then add ignoreOlderThan=7d to each inputs stanza and see if that works.

[andrei1bc]

From what i can see you are placing the inputs under the default folder. It is recommended to make use of the local folder.

Place under inputs.conf that is under : ../splunk/etc/apps/search/local

The hostname will be picked up from the default inputs.conf and it is not needed a 2nd time under the local inputs.conf

 [monitor:///MClogs/MC2016MC2Domain1_SP4/*.log]
 disabled = 0
 sourcetype = MC2016MC2_Domain1_Logs
 index = gptr_Blade

 [monitor:///MClogs/MC2016MC2Domain2_SP4/*.log]
 disabled = 0
 sourcetype = MC2016MC2_Domain2_Logs
 index = gptr_Blade

 [monitor:///MClogs/MC2016MC2Domain3_SP4/*.log]
 disabled = 0
 sourcetype = MC2016MC2_Domain3_Logs
 index = gptr_Blade

[baujla]

Hi, Here is my inputs.conf file:

[default]
host = Hosta

[monitor:///MClogs/MC2016MC2Domain1_SP4/*.log]
hostname = Hosta
disabled                = false
sourcetype              = MC2016MC2_Domain1_Logs
index                   = gptr_Blade

[monitor:///MClogs/MC2016MC2Domain2_SP4/*.log]
hostname = Hosta
disabled                = false
sourcetype              = MC2016MC2_Domain2_Logs
index                   = gptr_Blade

[monitor:///MClogs/MC2016MC2Domain3_SP4/*.log]
hostname = Hosta
disabled                = false
sourcetype              = MC2016MC2_Domain3_Logs
index                   = gptr_Blade

The three log files are MC2016MC2Domain1_SP4.log, MC2016MC2Domain2_SP4.log and MC2016MC2Domain3_SP4.log. One in each of the respective paths defined above.

Yes, I am using single indexer with single host trying to forward 3 source using 1 forwarder. Please let me know if you need more info.

[skoelpin]

Can you show us your inputs.conf file?

Can you also provide us the 3 path's and log names?

I'm assuming you're running a single indexer with a single host trying to forward 3 sources using 1 forwarder?