Current setup for forwarder server is, it sends data to 2 indexes. One for the TA NIX index and the other index is being used for some log files. No data is coming for TA NIX index but for the log files index, data is coming correctly. I checked in splunkd.log and could not see any error related to TA NIX scripts.
There was some execute permission issue with one TA-NIX (cpu.sh) script and that time data was coming correctly in the corresponding index for the other scripts. I fixed the permission issue and restarted the forwarder. After that, no data is getting reported for TA NIX index.
Can you please help here how to debug this issue.
↧