https://community.splunk.com/t5/Deployment-Architecture/How-forwarder-is-sending-data-to-indexers-Sudden-error-in-1/m-p/503142#M17248 <P>Actually there were some problems with one of the UF sending data to our indexers suddenly, therefore we had to restart the splunk service. Therefore:<BR /> 1. I want to know the METHOD(REST, HTTP ETC) by which our 1 of the forwarder is sending data to our indexers.<BR /> 2. I want to know, where to find the logs that contain the information regarding the connection and other parameters between indexers and forwarder.<BR /> 3. If you have the splunk query like index.... you are most welcome. </P> <P>Thankyou</P> Mon, 21 Oct 2019 03:49:27 GMT muizash 2019-10-21T03:49:27Z https://community.splunk.com/t5/Deployment-Architecture/How-forwarder-is-sending-data-to-indexers-Sudden-error-in-1/m-p/503142#M17248 <P>Actually there were some problems with one of the UF sending data to our indexers suddenly, therefore we had to restart the splunk service. Therefore:<BR /> 1. I want to know the METHOD(REST, HTTP ETC) by which our 1 of the forwarder is sending data to our indexers.<BR /> 2. I want to know, where to find the logs that contain the information regarding the connection and other parameters between indexers and forwarder.<BR /> 3. If you have the splunk query like index.... you are most welcome. </P> <P>Thankyou</P> Mon, 21 Oct 2019 03:49:27 GMT https://community.splunk.com/t5/Deployment-Architecture/How-forwarder-is-sending-data-to-indexers-Sudden-error-in-1/m-p/503142#M17248 muizash 2019-10-21T03:49:27Z https://community.splunk.com/t5/Deployment-Architecture/How-forwarder-is-sending-data-to-indexers-Sudden-error-in-1/m-p/503143#M17249 <P>Question 1 : this command will show what at the inputs that is being monitor<BR /> splunk _internal call /admin/inputstatus/TailingProcessor:FileStatus<BR /> In general, there is an input configuration to monitor the log files.</P> <P>Question 2: Splunk create the logs under <BR /> /$splunk_home/var/log/splunk</P> <P>Question 3 : There are some queries here<BR /> <A href="https://docs.splunk.com/Documentation/Splunk/6.5.1/Troubleshooting/Cantfinddata#Are_you_using_forwarders.3F">https://docs.splunk.com/Documentation/Splunk/6.5.1/Troubleshooting/Cantfinddata#Are_you_using_forwarders.3F</A></P> <P>for further information, read this post : <A href="https://answers.splunk.com/answers/62908/universal-forwarder-not-load-balancing-to-indexers.html">https://answers.splunk.com/answers/62908/universal-forwarder-not-load-balancing-to-indexers.html</A></P> Mon, 21 Oct 2019 04:41:16 GMT https://community.splunk.com/t5/Deployment-Architecture/How-forwarder-is-sending-data-to-indexers-Sudden-error-in-1/m-p/503143#M17249 ivanreis 2019-10-21T04:41:16Z https://community.splunk.com/t5/Deployment-Architecture/How-forwarder-is-sending-data-to-indexers-Sudden-error-in-1/m-p/503144#M17250 <P>@ivanreis Could you please elaborate on point 1. Where to run command and other details?</P> Mon, 21 Oct 2019 08:30:35 GMT https://community.splunk.com/t5/Deployment-Architecture/How-forwarder-is-sending-data-to-indexers-Sudden-error-in-1/m-p/503144#M17250 muizash 2019-10-21T08:30:35Z https://community.splunk.com/t5/Deployment-Architecture/How-forwarder-is-sending-data-to-indexers-Sudden-error-in-1/m-p/503145#M17251 <OL> <LI>login to the source server where the UF client is installed 2.Under path /splunkforwarder/bin/splunk _internal call /admin/inputstatus/TailingProcessor:FileStatus this will list all inputs on the xml file format on your screen and you are able to see all the inputs that splunk is monitoring</LI> </OL> <P>Other option, run the step 1 and run this command ./splunk list monitor, this is also listed all the inputs that are being monitoring</P> Tue, 22 Oct 2019 04:21:35 GMT https://community.splunk.com/t5/Deployment-Architecture/How-forwarder-is-sending-data-to-indexers-Sudden-error-in-1/m-p/503145#M17251 ivanreis 2019-10-22T04:21:35Z