Hi all,
In our environment, we have several Windows UF managed by a deployment server. We didn´t apply any change on the forwarders, and some of them are unable to send some of the data to the indexers. The data we are not receiving is the one wich come from a file (internal logs, monitoring files, etc). TCP/UDP inputs are working fine.
We have checked the permissions, and splunk user has total control over splunk folders and log files folders. We also reset fishbucket in order to discard any issue with it. No errors appear on the splunkd log inside the UF.
Does anybody know how to troubleshoot this?
Thanks in advance.
↧