If the inputs are not generating the data that you are expecting to see, there are a couple of troubleshooting measures that you can try to diagnose any issues.

  1. Run the following search to check for any error messages that have been generated that relate to MuleSoft:
index=_internal WARN OR ERROR mulesoft source="/opt/splunk/var/log/splunk/splunkd.log" 
  1. The app has an error logging system that logs information whenever an API call fails. To locate these error messages (if they exist) run the following search (adjust to your need):
index=_internal ERROR <input_name>

If there have been any errors generated, then there will be events of the form:

"input": <input_name>, 
"url": <api_endpoint>,
"status": <http_status_code>, 
"message": <JSON_text_returned>,
“org_id”: <org_id> (if present),
“env_id”: <env_id> (if present) 

If the message suggests that there are access issues, be sure that the account credentials you have provided have ‘Read Applications’ permissions in Mulesoft for the environment you are looking at.

Posted by:Becky Nielsen

Becky is a certified Splunk Admin, who has been working for iDelta since graduating from CodeClan's Professional Software Development course in 2019. Previously an archivist at several institutions around the UK, she holds an MSc in Information Management and Preservation from the University of Glasgow.