Getting Data In

log injection configuration

raghunandan1
Engager

Recently configured a new input that has successfully ingesting logs but appears to be working intermittently. There is large gaps in logs that we have confirmed are present and being created regularly from the source server.

Example : Logs are captured 8th December and 16 December only. So, here 9th December to 15nth December logs are not captured

We have created custom app on our deployment server and push that app across all the deployment slaves.

The data flow is coming from source-->Universal forwarder-->Heavy forwarder--> Splunk cloud

we have created Inputs.conf 

[monitor://F:\Polarion\data\logs\main\*.log.*]
sourcetype = catalina
index = ito_app
disabled = false
ignoreOlderThan = 7d
initCrcLength = 10000

Please help on the issue

Thank you

0 Karma

VatsalJagani
SplunkTrust
SplunkTrust

@raghunandan1 - Please search in the index=_internal to see if you have errors related to file monitoring from those hosts.

 

I hope this helps!!!

0 Karma

isoutamo
SplunkTrust
SplunkTrust
0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...

Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...