topic Re: Forwarder not indexing in Getting Data In

Forwarder not indexing

rcovert — Tue, 05 Jun 2012 17:52:10 GMT

I have one Linux indexer and 2 Linux forwarders. I just moved my indexer to a new server and have everything set up again. I changed the receiving server in both of my forwarders in /opt/splunkforwarder/etc/system/local/outputs.conf to point to the new IP address.

In the Deployment monitor app, I see both forwarders and it looks like data is coming in from both of them. But, when I look in the search app, it is not showing data coming from one of the forwarders under hosts. Any ideas?

Re: Forwarder not indexing

sdaniels — Tue, 05 Jun 2012 18:07:47 GMT

Are you seeing anything in your splunkd log?
/var/log/splunk

or in the UI via this search

index="_internal" source="/Applications/Splunk/splunk/var/log/splunk/splunkd.log"

Re: Forwarder not indexing

rcovert — Mon, 28 Sep 2020 11:54:22 GMT

This is being repeated in the splunkd.log on the forwarder:

06-05-2012 14:22:35.044 -0400 ERROR pipeline - Runtime exception in pipeline: parsing, processor: tcp-output-light-forwarder, error: vector::_M_range_check
06-05-2012 14:22:35.044 -0400 ERROR splunklogger - Uncaught exception in pipeline execution (tcp-output-light-forwarder) - getting next event

index="_internal" source="/Applications/Splunk/splunk/var/log/splunk/splunkd.log" shows 0 results.

Re: Forwarder not indexing

rcovert — Tue, 05 Jun 2012 19:14:43 GMT

I found the answer. Grr..

I had a extra space between a ":" and the IP address of the indexer.