splunk deployment

[sswarna1]

Since i had blunk changes of updating the log files on around 10 machines, I created a app in the deployment server and run the CLI command, but i can see the internal logs ingested but index created for this application showing no data post the change. what would be the issue.

[jkat54]

Check

index=_internal host=yourforwarder log_level=warn* OR log_level=err*

See if any errors like permission denied.

Also be sure the forwarders restarted after the change.

Check to be sure the path in inputs.conf is correct.

Check to be sure there aren't any extra characters like windows line endings (^M) or any missing square brackets [ or ]

[richgalloway]

What CLI command did you run? Did you look for the data in other indexes, in case there is an error in the configuration? Expand the time window of your search in case timestamps were mis-interpreted.

[sswarna1]

./splunk reload deploy-server was the command for serverclass.conf file, yes in internal indexers it is working fine, latest logs are updated. but for the indexer im pointing to in the inputs.conf in app data is not showing up. if i expand timestamp late log that is showing is before the change was made those logs.

[richgalloway]

What change(s) did you make?
Does the index exist?

[sswarna1]

yes index exists, changes mean changing the log path in deployment server app

[richgalloway]

Could you be more specific about the changes made? It seems like an error may have been made with them.