Getting Data In

Why is the universal forwarder not forwarding some lines in my logs?

raiszani
New Member

I'd set up the universal forwarder to send my logs to another server and it's working, but it's losing part of some lines in the process, as shown in the image attached. Does anyone knows how to solve that?

alt text

0 Karma

deepthi5
Path Finder

Hello ,

It looks like the parsing rules for the events to break were not defined properly please use the below stanza in your props.conf file and save and restart you splunk service
Replace sourcetypename with the sourcetype name of your log

[sourcetypename]
TIME_FORMAT = %Y.%m.%d.%H:%M:%S:%3N
MAX_TIMESTAMP_LOOKAHEAD = 23
NO_BINARY_CHECK = 1
pulldown_type = 1
SHOULD_LINEMERGE=true
BREAK_ONLY_BEFORE =^\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}\,\d{3}

0 Karma

raiszani
New Member

Thanks for your answer. I did it a try and still not working.
Actually i'm using 2 sourcetypes: CSV and Catalina

0 Karma

jkat54
SplunkTrust
SplunkTrust

Looks like a bad line_breaker regex. Can you post your props.conf from the forwarder & indexers? Or if you're in a single instance environment, just the props.conf?

0 Karma

raiszani
New Member

Sure. Here is the link:

http://pastebin.com/qkr7UBnW

0 Karma
Get Updates on the Splunk Community!

Thanks for the Memories! Splunk University, .conf24, and Community Connections

Thank you to everyone in the Splunk Community who joined us for .conf24 – starting with Splunk University and ...

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...