Monitoring Splunk

I am cloning _json sourcetype on managed splunk cloud to new custom name , the logs are not coming from log4j configuration

Nikhilsplunker
New Member

I have cloned a _json sourcetype to a custom sourcetype name and gave the correct URI for managed splunk cloud , still not being able to send logs to managed splunkcloud . I have also created a custom sourcetype cloning json_no_timestamp , it works, what are we missing
1) Is the issue on sourcetype definition or log4j configuration?
2) How to correct it ?

Tags (1)
0 Karma

Nikhilsplunker
New Member

Thanks will have a look and post back

0 Karma

woodcock
Esteemed Legend

We need more detail. In any case, check the error logs for splunkd and there is probably something there that you can fix.

0 Karma
Get Updates on the Splunk Community!

New Year, New Changes for Splunk Certifications

As we embrace a new year, we’re making a small but important update to the Splunk Certification ...

Stay Connected: Your Guide to January Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...

[Puzzles] Solve, Learn, Repeat: Reprocessing XML into Fixed-Length Events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...