https://community.splunk.com/t5/Deployment-Architecture/Splunkforwarder-stopped-sending-data-randomly/m-p/368945#M13587 <P>hello there,<BR /> first check if you can see data from forwarders in index=_internal<BR /> if so, it means the forwarders do send data to indexers and therefore check inputs<BR /> another option is to follow that article:<BR /> <A href="http://docs.splunk.com/Documentation/Splunk/6.6.1/Troubleshooting/Cantfinddata">http://docs.splunk.com/Documentation/Splunk/6.6.1/Troubleshooting/Cantfinddata</A><BR /> hope it helps</P> Fri, 23 Jun 2017 01:55:44 GMT adonio 2017-06-23T01:55:44Z https://community.splunk.com/t5/Deployment-Architecture/Splunkforwarder-stopped-sending-data-randomly/m-p/368944#M13586 <P>Hey Guys!</P> <P>So I have 2 forwarders they had stopped sending current data, I looked over the splunk config with a splunk contractor and found their was nothing wrong with the splunk config. So he told me to check and see if there were possibly any firewalls rules blocking traffic, so I went to the FW team and everything seems good from that aspect because out of nowhere one of the servers starts reporting data again, but the other server is still no reporting data......would anybody have any idea what could be wrong?</P> <UL> <LI>I checked to make sure the splunkwarder was running with the <STRONG>./splunk status</STRONG></LI> <LI>I made sure the files were being monitored on the forwarder with the <STRONG>./splunk list monitor</STRONG> command</LI> <LI>I made sure the timestamp was okay by checking the time on the event versus its _time (but the servers are located in eastern time so time format shouldn't be an issue) (And plus the other server started pulling current data, and they have the same splunk config)</LI> </UL> <P>Would there be any other thing I should check that I haven't listed above?</P> <P>Thanks for the help!</P> Thu, 22 Jun 2017 20:34:53 GMT https://community.splunk.com/t5/Deployment-Architecture/Splunkforwarder-stopped-sending-data-randomly/m-p/368944#M13586 qfulgham 2017-06-22T20:34:53Z https://community.splunk.com/t5/Deployment-Architecture/Splunkforwarder-stopped-sending-data-randomly/m-p/368945#M13587 <P>hello there,<BR /> first check if you can see data from forwarders in index=_internal<BR /> if so, it means the forwarders do send data to indexers and therefore check inputs<BR /> another option is to follow that article:<BR /> <A href="http://docs.splunk.com/Documentation/Splunk/6.6.1/Troubleshooting/Cantfinddata">http://docs.splunk.com/Documentation/Splunk/6.6.1/Troubleshooting/Cantfinddata</A><BR /> hope it helps</P> Fri, 23 Jun 2017 01:55:44 GMT https://community.splunk.com/t5/Deployment-Architecture/Splunkforwarder-stopped-sending-data-randomly/m-p/368945#M13587 adonio 2017-06-23T01:55:44Z