Getting Data In

log injection configuration

raghunandan1
Engager

Recently configured a new input that has successfully ingesting logs but appears to be working intermittently. There is large gaps in logs that we have confirmed are present and being created regularly from the source server.

Example : Logs are captured 8th December and 16 December only. So, here 9th December to 15nth December logs are not captured

We have created custom app on our deployment server and push that app across all the deployment slaves.

The data flow is coming from source-->Universal forwarder-->Heavy forwarder--> Splunk cloud

we have created Inputs.conf 

[monitor://F:\Polarion\data\logs\main\*.log.*]
sourcetype = catalina
index = ito_app
disabled = false
ignoreOlderThan = 7d
initCrcLength = 10000

Please help on the issue

Thank you

0 Karma

VatsalJagani
SplunkTrust
SplunkTrust

@raghunandan1 - Please search in the index=_internal to see if you have errors related to file monitoring from those hosts.

 

I hope this helps!!!

0 Karma

isoutamo
SplunkTrust
SplunkTrust
0 Karma
Get Updates on the Splunk Community!

Splunk Classroom Chronicles: Training Tales and Testimonials

Welcome to the "Splunk Classroom Chronicles" series, created to help curious, career-minded learners get ...

Access Tokens Page - New & Improved

Splunk Observability Cloud recently launched an improved design for the access tokens page for better ...

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

🍂 Fall into November with a fresh lineup of Community Office Hours, Tech Talks, and Webinars we’ve ...