Splunk Enterprise Security

Splunk kb store and logs recieving issue on indexer

Dk123
Observer

Hello. I have created an index under a custom app from splunk web it is reflecting but we I have set up the univarsal forwarder to monitor logs for same index it is not reflecting anything on indexer.

 

Also my kb store showing status failed and tell me to check mongod.log and splunk key   , please help in this

Labels (2)
0 Karma

livehybrid
Influencer

For your first issue, relating to the data not being received into Splunk, please check the your inputs.conf on the UF is setup to the same index name as you have defined in the indexes.conf on your indexers.

You should also check that your user has permissions to see this index on your searchhead.

Regarding the mongo issue, please can you confirm which version of Splunk you are running and if was a fresh install or an upgrade from a previous version?
Its worth starting with splunkd.log/mongod.log in $SPLUNK_HOME/var/log/splunk (or look in the _internal index for these logs) to see if there are any error/fatal/critical errors that might point to why Mongo isnt starting.

If you find anything in the logs then let us know here and we can try and help you work through it.

Regards

Will

0 Karma

Dikshi
Loves-to-Learn Lots

Fresh installation 9.4.0 errors showing for kvstore provider , http connection error

0 Karma
Get Updates on the Splunk Community!

Get Schooled with Splunk Education: Explore Our Latest Courses

At Splunk Education, we’re dedicated to providing incredible learning experiences that cater to every skill ...

Splunk AI Assistant for SPL | Key Use Cases to Unlock the Power of SPL

Splunk AI Assistant for SPL | Key Use Cases to Unlock the Power of SPL  The Splunk AI Assistant for SPL ...

Buttercup Games: Further Dashboarding Techniques (Part 5)

This series of blogs assumes you have already completed the Splunk Enterprise Search Tutorial as it uses the ...