Deployment Architecture

Splunk Forwarder do not send all data

clementros
Path Finder

Hi,

I have installed splunk forwarder 8.0.2 to send data to the splunk entreprise 7.3.0.

All day, multiple .err files are created on my client server. I want to monitor all of them. Sometimes .err files are empty, sometimes they are small heavy and sometimes they are very big.

In my splunk entreprise web interface i do not see all of my .err file. I can see .err files only from August 3 from October 23. Where is other files for today and other days ?

I had some crc length errors. Know i use the parameter crcSalt = <SOURCE>

Here is my inputs.conf :

[monitor:///prddata/JobOutput/*/*.err]
index=fileauxnfmerrorlogs
sourcetype=fcravd10logfile
crcSalt = <SOURCE>

Here is my outputs.conf:

[tcpout:splunkdev]
server=sapoxt3.os.amadeus.net:9997

How can i troobleshoot this ?

Regards,

0 Karma

kartm2020
Communicator

Hi @clementros

It is always recommended to install the same version in both indexers and forwarders. However the issue is with crclength. So you need to increase the initcrclength attribute value 512 or 1024. Try it first 512 if it doesnt works try with 1024. Increase the value by 256.
Default value of inicrclength is 256

[monitor:///prddata/JobOutput//.err]
index=fileauxnfmerrorlogs
sourcetype=fcravd10logfile
initCrcLength = 1024

Hope it works. Let me know if you are facing error after you did the above changes.

You can also go through the below link.
https://docs.splunk.com/Documentation/Splunk/8.0.2/Data/Howlogfilerotationishandled

Happy splunking!!!

0 Karma

manjunathmeti
SplunkTrust
SplunkTrust

Just search index and see if data is there. Splunk sets sourcetype for small files to too_small.

index=fileauxnfmerrorlogs
0 Karma

clementros
Path Finder

No they are not

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @clementros,
probably the problem is that you should always have on Indexers the same or higher release than the Forwarders.
Try to install the same version or upgrade (if possible) the Indexer.
For more infos see at https://docs.splunk.com/Documentation/Forwarder/8.0.2/Forwarder/Compatibilitybetweenforwardersandind...

Ciao.
Giuseppe

clementros
Path Finder

Is my license need to be change or the license is independent from the version ?

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @clementros,
License is indipendent by the version.
beware, if you want to upgrade to 8, because the last version is really different and you, before upgrading, have to check apps compatibility.

Ciao.
Giuseppe

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...