Splunk Search

I can't collect logs in splunk GUI after splunk configuration

pacifikn
Communicator

Hello!!!!

I can't collect logs in Splunk after Splunk configuration
I have done all configuration but I still not getting logs in Splunk?

  1. I verified that logs come from Syslog sender are well received, and also doing Splunk configuration

when I search index=* I can't find index=xxxx expected, why? where can I check and fix this??

  1. Other issues, is that I get a message that says, msg=A script exited abnormally with exit status:1" input=".$SPLUNK_HOME/etc/apps/splunk_instrumentation/bin/instrumentation.py" stanza=" default" -->the error identified by health check, how to fix this?

Kindly help me on the above issues, thank you

0 Karma

pacifikn
Communicator

Hi Jawaharas! the issue was fixed, The issue was lack of available storage on the /opt partition that received all logs from Syslog sender on the Splunk Management node, This caused the Splunk Forwarder to stop working, the issue was managed and fixed. everything is fine now. Thank you a lot for your kind help!

0 Karma

jawaharas
Motivator

I'm glad you figured it out.

0 Karma

jawaharas
Motivator
  1. How do you verified that logs come from Syslog sender are well received?
  2. What Splunk configuration performed?
  3. Is the UDP port open (in Splunk) for the syslog servers?
0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...