Troubleshooting the integration
Refer to the following common solutions if you encounter issues with this integration:
- Splunk does not show any data:
- Make sure that you have file read and write access to the log directory.
- Ensure that your firewall rules are correct.
- Try searching withindex=*and identify where the source originates. The source may not match the forwarder configuration in theC:\Program Files\SplunkUniversalForwarder\etc\system\local\inputs.conffile (for example,[monitor://C:\StreamingServiceReferenceClient\EventLogs\event.log]).
- You receive a SplunkCooked Dataerror:--splunk-cooked-mode-v3--\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\ x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\The indexer is sent TCP raw data. Verify that you created your receiver correctly.
Testing Connectivity
At any time, you can test connectivity by forcing synchronization. As an administrator on the computer running the VIP Report Streaming Service reference client, run the following command at a command line:
splunk add oneshot <path_to_event_log_dir> -index <index_name> -sourcetype <source_name> -host <host_name>
Where:
- <path_to_event_log_dir>is the path to the event logs directory (event_log_dir) you set when you configured theVIP Report Streaming Service reference client.
- <index_name>is the name of your Splunk Cloud index.
- <source_type>is the custom source type you created in theprops.conf. Entervip_apifor this value.
- <host_name>is the host name of the computer that is running the VIP Report Streaming Service reference client.
For example:
splunk add oneshot "C:\StreamingReferenceClient\logs\event.log" -index vip_api -sourcetype vip_api -host myhostname