Getting Data In

log injection configuration

raghunandan1
Engager

Recently configured a new input that has successfully ingesting logs but appears to be working intermittently. There is large gaps in logs that we have confirmed are present and being created regularly from the source server.

Example : Logs are captured 8th December and 16 December only. So, here 9th December to 15nth December logs are not captured

We have created custom app on our deployment server and push that app across all the deployment slaves.

The data flow is coming from source-->Universal forwarder-->Heavy forwarder--> Splunk cloud

we have created Inputs.conf 

[monitor://F:\Polarion\data\logs\main\*.log.*]
sourcetype = catalina
index = ito_app
disabled = false
ignoreOlderThan = 7d
initCrcLength = 10000

Please help on the issue

Thank you

0 Karma

VatsalJagani
SplunkTrust
SplunkTrust

@raghunandan1 - Please search in the index=_internal to see if you have errors related to file monitoring from those hosts.

 

I hope this helps!!!

0 Karma

isoutamo
SplunkTrust
SplunkTrust
0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...