Getting Data In

Why are logs not getting in from Linux machine?

an
Explorer

Logs are not getting in from Linux machine

I am using Splunk cloud trial and in a Linux machine and installed universal forwarder and added 

monitor path as well. But no luck.

Labels (2)
0 Karma
1 Solution

an
Explorer

Problem solved, by reinstalling the UF. Thanks

View solution in original post

0 Karma

an
Explorer

Problem solved, by reinstalling the UF. Thanks

0 Karma

danielcj
Communicator

Hello @an ,

You could do the following to troubleshoot this issue:

1 - Download the Universal Forwarder app from your Splunk Cloud trial instance and install it on /opt/splunkforwarder/etc/apps (If you not already installed this app).

2 - Verify the permissions of the files that you added on the monitor path (if the user that is running Splunk can read/execute these files).

3 - Verify if the monitor configs are correct and an index is being defined on the monitor stanza.

4 - Run splunk btool check command to check for any typos on .conf files.

5 - Restart the Universal Forwarder (The changes on the Universal Forwarder are only applied after a restart).

6 - Search for index=_internal host=<your_uf_host> on Splunk Cloud trial to verify if internal logs are being indexed. If the internal logs are being indexed, search for the index that you configured your monitor on the step 3.
6.1 - If there are internal logs from your instance but there are no logs on your index, there is an error on the configs of this input.
6.2 - If there are no internal logs, the error could be related to a firewall issue that you could try to troubleshoot on the UF log files (search for an error that shows that you cannot connect to the Splunk Cloud): 
cat /opt/splunkforwarder/var/log/splunk/splunkd.log | grep -i ERROR

 

Thanks.

an
Explorer

Screenshot 2022-06-29 at 11.01.01 PM.pngScreenshot 2022-06-29 at 11.03.22 PM.pngScreenshot 2022-06-29 at 11.04.05 PM.pngthis is getting if i am running 

cat /opt/splunkforwarder/var/log/splunk/splunkd.log | grep -i ERROR

and copied input and output config

0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

When you are using Splunk Cloud then outputs.conf must contain TLS certs. It seems that you haven't those on your outputs.conf. Should be something like:

[tcpout]
defaultGroup = SC_STACK
useACK = true

[tcpout:SC_STACK]
server = inputs1.SC_STACK.splunkcloud.com:9997, inputs2.SC_STACK.splunkcloud.com:9997, ..... inputs15.SC_STACK.splunkcloud.com:9997
compressed = false

clientCert = $SPLUNK_HOME/etc/apps/100_SC_STACK_splunkcloud/default/SC_STACK_server.pem

sslCommonNameToCheck = *.SC_STACK.splunkcloud.com
sslVerifyServerCert = true
useClientSSLCompression = true

 

You could download a new valid UF connection package from your SC instance. Just select App "Universal Forwarder" on left side panel and follow it's instructions.

r. Ismo 

richgalloway
SplunkTrust
SplunkTrust

Double-check your firewalls to make sure they allow connections from the UF to Splunk Cloud.

The outputs.conf file doesn't look right.  There should be a certificate specified, but I don't see it.  Are you sure this is the outputs.conf that came with the 100_splunkclouduf app?

It's not necessary to specify source in a monitor clause.  The source field is populated automatically from the monitored file name.

---
If this reply helps you, Karma would be appreciated.

richgalloway
SplunkTrust
SplunkTrust

Did you install the Universal Forwarder app from your cloud SH on the UF?  Did you then restart the UF?

Have you checked the UF's logs to see if any messages might explain why it's unable to send to Splunk Cloud?

---
If this reply helps you, Karma would be appreciated.
0 Karma

an
Explorer

yes installed Universal Forwarder and restarted 

0 Karma
Get Updates on the Splunk Community!

What’s new on Splunk Lantern in August

This month’s Splunk Lantern update gives you the low-down on all of the articles we’ve published over the past ...

Welcome to the Future of Data Search & Exploration

You have more data coming at you than ever before. Over the next five years, the total amount of digital data ...

This Week's Community Digest - Splunk Community Happenings [8.3.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...