I somehow lost my custom stanza's on my forwarder for sending syslog data to my indexer. I noticed that my forwarder was missing those from the forwarder on the deployment server, so I added that back and it I now see my custom stanza's for forwarder input.
I see events coming in to my forwarder but they are not being sent to the indexer or at least not searchable on my search head.
How do I debug this?
Thanks!
↧