Splunk IT Service Intelligence

I see traffic from forwarder to indexers, but I cant find anything when I search on the search heads.

millinkan
New Member

I have installed a forwarder on my apache serer and I see traffic (logs) moving from the web server to the indexers.
When I run the command below on my search heads (plus ITSI), I get nothing.

| eventcount summarize=false index=* index=_* | dedup index | fields index

my input.conf:
[monitor:///web/JBossWeb/jws-3.0/https/logs/access.log.$(date +%Y.%m.%d)]
sourcetype=apache_access
disabled = 0
index = apache

[monitor:///web/JBossWeb/jws-3.0/https/logs/error.log.$(date +%Y.%m.%d)]
sourcetype=apache_error
disabled = 0
index = apache

Please help.
Thank you.

Labels (1)
0 Karma

lloydknight
Builder

you cannot search anything on the SH (assuming no data on index=apache) but you see traffic logs (assuming the forwarder is already connected to the indexers)

have you tried checking on splunkd.log if there are any errors? are the sources being monitored? (run ./splunk list monitor on the UF)

0 Karma

skalliger
SplunkTrust
SplunkTrust

What are you trying to do? Get an eventcount? Because that's what the search does. There's a small mistake in your search, should be | eventcount summarize=false index=* index=_* | dedup index | fields index

Also, you can write | eventcount summarize=false index=* index=_* | stats values(index) instead.

Skalli

0 Karma

millinkan
New Member

Thanks for the alternate search query.

0 Karma

millinkan
New Member

I used the below in my inputs.conf and it worked.

[monitor:///web/JBossWeb/jws-3.0/httpd/logs/error.log.*]
sourcetype=apache_error
disabled = 0
index = linux
crcSalt=
ignoreOlderThan = 0d

Thanks for you assistance

0 Karma
Get Updates on the Splunk Community!

Splunk Life | Happy Pride Month!

Happy Pride Month, Splunk Community! 🌈 In the United States, as well as many countries around the ...

SplunkTrust | Where Are They Now - Michael Uschmann

The Background Five years ago, Splunk published several videos showcasing members of the SplunkTrust to share ...

Admin Your Splunk Cloud, Your Way

Join us to maximize different techniques to best tune Splunk Cloud. In this Tech Enablement, you will get ...