Splunk Search

Universal Forwarder - Not Forwarding Data - Intermittent Issue

madhav_dholakia
Contributor

Hi All,

We have a universal forwarder running on Windows Server which is sending data to our Splunk Instance in Cloud.

Below are some details of .conf files and logs:

inputs.conf

[default]
host = DB_DATA

[monitor://D:\ABC\DB_Monitoring\Cust]
disabled=0
index=rjsql
sourcetype = csv
crcSalt = <SOURCE>
time_before_close = 60

props.conf

[default]
NO_BINARY_CHECK=true
CHARSET=AUTO

[source::D:\ABC\DB_Monitoring\Cust\*.csv]
CHECK_METHOD = modtime

There are some files which are either 1) no being indexed at all 2) only headers are indexed - this doesn't happen with all the files, only some of them.

Logs from _internal (for file which has got only header indexed)

madhav_dholakia_1-1655378730697.png

Tailing processer file status

madhav_dholakia_2-1655378896371.png

btool output:

madhav_dholakia_3-1655379120242.png

Can you please suggest what else I could check here and resolve this intermittent issue?

Thank you.

Labels (1)
0 Karma

VatsalJagani
SplunkTrust
SplunkTrust

@madhav_dholakia - Your configuration looks correct to me.

 

I think you should observe how your system is overriding the data in the CSV files every time, how and when they are writing in the file, what is the size of the files, and how long it's taking to write a file.

Please monitor the above parameters on the host for files which are having this more than other files and compare. I think that should lead you to the root cause that is causing this intermittent issue.

 

I hope this helps!!!

0 Karma

madhav_dholakia
Contributor

thanks, @VatsalJagani - these files are <10KBs and updated every 15 days/month. With a time_before_close param set, I don't think file writing will take more time looking at the file size.

0 Karma

VatsalJagani
SplunkTrust
SplunkTrust

Yeah, file size, I don't think should be a problem here then.

0 Karma
Get Updates on the Splunk Community!

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...

Industry Solutions for Supply Chain and OT, Amazon Use Cases, Plus More New Articles ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Enterprise Security Content Update (ESCU) | New Releases

In November, the Splunk Threat Research Team had one release of new security content via the Enterprise ...