Splunk Enterprise

Splunk app for Logbinder - Event Entries empty

New Member

Hi guys,

I installed Supercharger, Splunk and Splunk app for Logbinder in order to configure log forwarders and have them visualized within Splunk (like here https://support.logbinder.com/SuperchargerKB/50135/8-Install-Supercharger-with-Splunk-Light-and-the-...)
So far everything worked flawless, Events are forwarded and collected but when looking at the event entries in Splunk they are not showing any data:

alt text

When looking inside the forwarded Events everything looks as it should, only what is displayed in Splunk is wrong.
Help really appreciated!

Thanks and Regards

One additional question: The forwarded events are stored in a event file. Are they also stored within the SQL DB which Logbinder creates? Only relying on this file seems a bit crazy to me? How is Splunk crawling this file?

Tags (2)
0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.