topic Re: Forwarder stopped pushing performance data in Deployment Architecture

Forwarder stopped pushing performance data

siddharthmis — Thu, 30 Mar 2017 04:15:34 GMT

Hi,

I had a completely working setup where forwarder was pushing data to UF successfully but it stopped pushing data a week earlier.
There is no error in splunkd.log which can explain the reason.

How do I fix it?

All other indexes are working fine. It's just that performance counters are not pushed. Registry values are fine.

Re: Forwarder stopped pushing performance data

adonio — Thu, 30 Mar 2017 13:49:38 GMT

Hi siddharthmis,
do you mean forwarder pushed data to another forwarder (UF) ? or forwarder sending data to indexer and now it does not send data anymore?

Re: Forwarder stopped pushing performance data

ppeterson — Thu, 30 Mar 2017 19:50:29 GMT

version/OS info would help, have you tried restarting from the CLI?

Re: Forwarder stopped pushing performance data

siddharthmis — Fri, 31 Mar 2017 02:45:46 GMT

I mean it stopped pushing data to Splunk deployment (indexer)

Re: Forwarder stopped pushing performance data

siddharthmis — Fri, 31 Mar 2017 06:08:42 GMT

Yes but in Vain

Re: Forwarder stopped pushing performance data

gcusello — Fri, 31 Mar 2017 08:55:41 GMT

Hi siddharthmis,
only three foolish questions:

forwarder time and date are the same of Indexers?
did you checked if you're receiving logs in _internal index?
surely you checked connection using telnet (telnet indexer_IP 9997).

Bye.
Giuseppe

Re: Forwarder stopped pushing performance data

tlam_splunk — Fri, 31 Mar 2017 09:11:48 GMT

Hi siddharthmis, are you using Window Perfmon stanza in the UF ?