Splunk Search

Universal Forwarder - Not Forwarding Data - Intermittent Issue

madhav_dholakia
Contributor

Hi All,

We have a universal forwarder running on Windows Server which is sending data to our Splunk Instance in Cloud.

Below are some details of .conf files and logs:

inputs.conf

[default]
host = DB_DATA

[monitor://D:\ABC\DB_Monitoring\Cust]
disabled=0
index=rjsql
sourcetype = csv
crcSalt = <SOURCE>
time_before_close = 60

props.conf

[default]
NO_BINARY_CHECK=true
CHARSET=AUTO

[source::D:\ABC\DB_Monitoring\Cust\*.csv]
CHECK_METHOD = modtime

There are some files which are either 1) no being indexed at all 2) only headers are indexed - this doesn't happen with all the files, only some of them.

Logs from _internal (for file which has got only header indexed)

madhav_dholakia_1-1655378730697.png

Tailing processer file status

madhav_dholakia_2-1655378896371.png

btool output:

madhav_dholakia_3-1655379120242.png

Can you please suggest what else I could check here and resolve this intermittent issue?

Thank you.

Labels (1)
0 Karma

VatsalJagani
SplunkTrust
SplunkTrust

@madhav_dholakia - Your configuration looks correct to me.

 

I think you should observe how your system is overriding the data in the CSV files every time, how and when they are writing in the file, what is the size of the files, and how long it's taking to write a file.

Please monitor the above parameters on the host for files which are having this more than other files and compare. I think that should lead you to the root cause that is causing this intermittent issue.

 

I hope this helps!!!

0 Karma

madhav_dholakia
Contributor

thanks, @VatsalJagani - these files are <10KBs and updated every 15 days/month. With a time_before_close param set, I don't think file writing will take more time looking at the file size.

0 Karma

VatsalJagani
SplunkTrust
SplunkTrust

Yeah, file size, I don't think should be a problem here then.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...