topic Re: SplunkForwarder not reporting\showing up on server in Deployment Architecture

SplunkForwarder not reporting\showing up on server

raphabaroudi — Wed, 14 Aug 2019 15:04:14 GMT

Hello all,

I've tried to locate an answer for this issue for the past few days with no luck. So I have decided to give it a shot here, perhaps someone ran into this issue before or at least can assist in providing assistance. Any feedback is greatly appreciated.

I am using Splunk with Dev license. Installed the forwarders on >200 Windows machines. Only about 55 are reporting back to the server. I am mainly looking in the data set > data summary > hosts to see the machines that are reporting. I am not sure why the remaining are not reporting back or showing up in the hosts list.

SplunkEnterprise Ver 7.2.6

Thank you for your time,

Re: SplunkForwarder not reporting\showing up on server

richgalloway — Wed, 14 Aug 2019 17:38:46 GMT

Try this alternative method to list your forwarders.

index=_internal group=tcpin_connections 
| stats latest(version) as version latest(arch) as arch latest(os) as os latest(fwdType) as fwdType by hostname

Re: SplunkForwarder not reporting\showing up on server

raphabaroudi — Thu, 15 Aug 2019 12:42:18 GMT

Thank you for the response. I have tried the method above and it indicates the same number of forwarders as the ones shown in the data summary.

Re: SplunkForwarder not reporting\showing up on server

richgalloway — Fri, 16 Aug 2019 12:36:09 GMT

Then you have the correct number. The next step is to determine why the remaining forwarders are not connecting. You'll need to sign in to a server that is not reporting and examine the splunkd.log file.

Re: SplunkForwarder not reporting\showing up on server

vinod94 — Sun, 18 Aug 2019 14:58:29 GMT

@raphabaroudi,

Did u check the connectivity between those forwarders and the Splunk instance?

Re: SplunkForwarder not reporting\showing up on server

raphabaroudi — Mon, 19 Aug 2019 11:25:38 GMT

I have on several of them, and the seemed to communicate properly. I am still going through the splunkd.log to see if anything stands out.