I can't collect logs in splunk GUI after splunk configuration

[pacifikn]

Hello!!!!

I can't collect logs in Splunk after Splunk configuration
I have done all configuration but I still not getting logs in Splunk?

1. I verified that logs come from Syslog sender are well received, and also doing Splunk configuration

when I search index=* I can't find index=xxxx expected, why? where can I check and fix this??

1. Other issues, is that I get a message that says, msg=A script exited abnormally with exit status:1" input=".$SPLUNK_HOME/etc/apps/splunk_instrumentation/bin/instrumentation.py" stanza=" default" -->the error identified by health check, how to fix this?

Kindly help me on the above issues, thank you

[pacifikn]

Hi Jawaharas! the issue was fixed, The issue was lack of available storage on the /opt partition that received all logs from Syslog sender on the Splunk Management node, This caused the Splunk Forwarder to stop working, the issue was managed and fixed. everything is fine now. Thank you a lot for your kind help!

[jawaharas]

I'm glad you figured it out.

[jawaharas]

1. How do you verified that logs come from Syslog sender are well received?
2. What Splunk configuration performed?
3. Is the UDP port open (in Splunk) for the syslog servers?