Splunk Universal Forwarder file monitoring folders are not sending data to Splunk server/Indexer.

Applicability

Splunk Enterprise

Description

 A user reported that the below-given files in inputs.conf of $SPLUNK_HOME/etc/system/local/ are not getting sent to their Splunk server / Indexer:

/incoming/salesforce_logs/loginEvents/ "date folder"/date_loginWithGeoInfo.csv

They were using one Splunk search head and one indexer in there the data is imported via a UF(Universal Forwarder) on a ubuntu log server.

 

Investigation

Run the below-given command, which is an easier way to check file monitoring :
1) Go to the path  /opt/splunk/bin

./splunk list inputstatus

The following file "/incoming/salesforce_logs/loginEvents/20180428/20180428_020003_loginWithGeoInfo.csv" is completely being read.
For e.g:

/incoming/salesforce_logs/loginEvents/20180428/20180428_020003_loginWithGeoInfo.csv
file position = 39155
file size = 39155
parent = /incoming/salesforce_logs/loginEvents
percent = 100.00
type = finished reading

2) Spotted the following configuration of inputs.conf in the following path $SPLUNK_HOME/etc/system/local/.

[monitor:///incoming/salesforce_logs/loginEvents]
index = salesforce_login
disabled = false
followTail = 0
host = salesforce

3) You should define the "sourcetype" while monitoring a file because declaring the sourcetype is important both for searchability and for applying the relevant formatting for this type of data during parsing and indexing. The Splunk platform picks a source type based on various aspects of the data as there is no default.
Examples of monitor input stanzas is the best way to have your input stanza validated.

4) Refer to the following document regarding the use of followTail .

 

Resolution

Have reproduced this in a test instance and the following configuration has resolved the issue as the user were having rotating logs and hence used "crcSalt" in the inputs.conf to the following path $SPLUNK_HOME/etc/system/local/

[monitor:///incoming/salesforce_logs/loginEvents]
crcSalt = <SOURCE>
index = salesforce_login
disabled = 0
sourcetype = provide your sourcetype

 If you use "CRCSALT = <SOURCE>" including <> and capitalisation, splunk will use the source file and folder name which will change for every file. Therefore each file looks different.

> Have performed a restart of the UF after making the above changes and after this Universal Forwarder started sending the data now.
 

Revision History

Revision	Publish Date	Comments
1.0	29-Sep-2026	Initial Release