topic Re: Splunk Health in Splunk Enterprise

Splunk Health

SN1 — Wed, 12 Feb 2025 07:16:41 GMT

Hi I am getting this error.

Root Cause(s):

More than 70% of forwarding destinations have failed. Ensure your hosts and ports in outputs.conf are correct. Also ensure that the indexers are all running, and that any SSL certificates being used for forwarding are correct

i have used telnet as well and it is getting connected.

richgalloway — Wed, 12 Feb 2025 13:25:42 GMT

Telnet will tell you if a network connection can be made, but won't say if the Splunk-to-Splunk protocol is working or not.

Have you confirmed all forwarders are running? Do they have the right outputs.conf settings? Are their certificates valid?

Have you looked at each forwarder's splunkd.log file to see what connection errors are being reported?

Do you replace forwarders often? If so, Splunk probably still expects to hear from the old ones and this message may be a false positive.

kiran_panchavat — Wed, 12 Feb 2025 15:21:07 GMT

Even though telnet is connecting, there might still be network issues or firewall rules affecting the Splunk traffic. Ensure that there are no firewalls blocking the traffic between the forwarders and indexers.
Make sure all your indexers are running and reachable. You can use the Splunk monitoring console to view the status of your indexers.
Check the resource usage on your forwarders and indexers. High CPU or memory usage can sometimes cause forwarding issues.
Then are you using an SSL certificate?
If yes, check the validity and the password of your certificate and that the certificate is used on UFs and IDXs.

kiran_panchavat — Wed, 12 Feb 2025 15:26:11 GMT

Here is one conf presentation which you probably could use to check if there is local issue or where the issue could be.