Getting Data In

Issue with receiving data

Gil
Explorer

hello,

I have a problem that I'm not receiving data to some of my indexes when it is related to monitoring.

 for the monitor I created an app in the server I pull the data from, it worked for a while and now it stopped.
the stanza of the inputs.conf looks like that:

[monitor://\\<my_server_ip>\<folder>\*.csv]
index=<my_index>
disabled = 0
ignoreOlderThan = 2d
sourcetype = csv
source=<source_name>

 

it happens in 2 indexes of mine that have the same stanza structure.

I checked the connection from my server to the monitor path and it was ok.

I checked the _internal index for errors with no results.

I opened wireshark no see any connections error which i didn't found any errors.

 

any ideas?

Labels (3)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @Gil,

maybe did ingestion run fine until the 31st of may and stop at the 1st of June?

if this is true, check the TIME_FORMAT of your logs: probably you are using an european date format (dd/mm/yyyy) and you didn't defined a TIME_FORMAT for your timestamps, so Splunk (that's america!) by default uses the american format (mm/dd/yyyy).

This means that you indexed todays log (5th of June) as logs of the 6th of May..

You should force the TIME_FORMAT for that sourcetype in props.conf.

Ciao.

Giuseppe

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi @Gil,

maybe did ingestion run fine until the 31st of may and stop at the 1st of June?

if this is true, check the TIME_FORMAT of your logs: probably you are using an european date format (dd/mm/yyyy) and you didn't defined a TIME_FORMAT for your timestamps, so Splunk (that's america!) by default uses the american format (mm/dd/yyyy).

This means that you indexed todays log (5th of June) as logs of the 6th of May..

You should force the TIME_FORMAT for that sourcetype in props.conf.

Ciao.

Giuseppe

gcusello
SplunkTrust
SplunkTrust

Hi @Gil ,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉

Gil
Explorer

Thank you for your help.

0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...