topic Re: Why is there data Ingestion Issue through Heavy Forwarder? in Getting Data In

Why is there data Ingestion Issue through Heavy Forwarder?

sahilvats — Tue, 15 Aug 2023 21:46:12 GMT

Hi ,

I am looking for troubleshooting steps for Data Ingestion Issue through Heavy Forwarder

Re: Why is there data Ingestion Issue through Heavy Forwarder?

gcusello — Wed, 16 Aug 2023 09:35:32 GMT

Hi @sahilvats,

could you share some additionsl information?

e.g.: are you ingesting syslog data from the HF?

data are ingested by UFs passing through the HF?

are you speaking ok local data, or DB-Connect data or Cloud data?

Ciao.

Giuseppe

Re: Why is there data Ingestion Issue through Heavy Forwarder?

sahilvats — Wed, 16 Aug 2023 13:16:19 GMT

Hi @gcusello

Thank you so much for the response.

We are ingesting data from remote machines, basically collecting logs from remote machines and forwarding them for further processing.

here i am looking to identify the basic troubleshooting guide for data ingestion issue through HF

Re: Why is there data Ingestion Issue through Heavy Forwarder?

gcusello — Wed, 16 Aug 2023 14:32:26 GMT

Hi @sahilvats,

if you're using an intermediate HF between UFs and Indexers, you don't need any input, but you have to add all the props.conf and transforms.conf to parse your data, because parsing in Splunk is executed in the first full Splunk Instance that te data passing through.

In other words: if you have to collect data from windows UFs, you have to install the Splunk_TA_Windows on UFs, on Search Heads and on HF.

Ciao.

Giuseppe

Re: Why is there data Ingestion Issue through Heavy Forwarder?

gcusello — Thu, 17 Aug 2023 06:55:06 GMT

Hi @sahilvats,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉