Monitoring Splunk

Weird Monitoring issue after AIX Universal Forwarder Upgrade

Path Finder


We have an issue with an AIX server that just doesn't seem to monitor a particular log file after it was upgraded from v4.3.2 to v6.4.2. All the other logs mentioned in the inputs.conf are working fine. It' just this particular stanza that seems to be having and issue and that too, just on this particular server. Other servers upgraded along with it don't have this issue. And there are no blank spaces or any of that sort. This was cross checked.

Stanza is in the following format.

index = abc
host = server1
sourcetype = def

Anyone faced similar issue after AIX UF upgrade?


Tags (1)
0 Karma


Does the user Splunk is running under have read permissions to the file?
Perhaps it was running under a different user before the upgrade.

If that's not the case are you seeing any specific errors?
You can also run the search below, look at the "file" field, and search for events related to the specific file:

index=_internal component=WatchedFile
0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...