Getting Data In
Highlighted

Why is my forwarder not forwarding data other than _internal?

Explorer

I have forwarder not forwarding any input data other than _internal.

Checks performed:
splunk version - 6.4.2
Forwarder is up and running.
Checked the $SPLUNKHOME/etc/system/local/inputs.conf . -- Checked the host name
Checked the $SPLUNK
HOME/etc/system/local/deploymentclient.conf
Checked the $SPLUNK_HOME/etc/system/local/server.conf
I don't see any error/warning in splunkd.log.
File path for the log files.

I have restarted the forwarder several times but no luck.
The inputs in the /etc/app are not forwarding.

Please advise.

0 Karma
Highlighted

Re: Why is my forwarder not forwarding data other than _internal?

Influencer

Does the log files have data in them to forward?
Cross check the path for any type-o ?

0 Karma
Highlighted

Re: Why is my forwarder not forwarding data other than _internal?

Explorer

Fixed, There was an mistake in the inputs whitelist. It works now. Thanks.

0 Karma