https://community.splunk.com/t5/Getting-Data-In/Entries-from-forwarder-not-appearing-after-upgrading-to-Splunk-6/m-p/135090#M27807 <P>Any idea why entries from forwarder local logs aren't being forwarded to the server after upgrading to Splunk 6.0. Have restarted the forwarder on the laptop but am still not getting transactions. About to have to restore to 5.x from the backup.</P> <P>Edited to note that we upgraded one laptop to the v6 forwarder, but it still isn't forwarding so it has to be something on the server/indexer side.</P> Fri, 08 Nov 2013 19:27:16 GMT RVDowning 2013-11-08T19:27:16Z https://community.splunk.com/t5/Getting-Data-In/Entries-from-forwarder-not-appearing-after-upgrading-to-Splunk-6/m-p/135090#M27807 <P>Any idea why entries from forwarder local logs aren't being forwarded to the server after upgrading to Splunk 6.0. Have restarted the forwarder on the laptop but am still not getting transactions. About to have to restore to 5.x from the backup.</P> <P>Edited to note that we upgraded one laptop to the v6 forwarder, but it still isn't forwarding so it has to be something on the server/indexer side.</P> Fri, 08 Nov 2013 19:27:16 GMT https://community.splunk.com/t5/Getting-Data-In/Entries-from-forwarder-not-appearing-after-upgrading-to-Splunk-6/m-p/135090#M27807 RVDowning 2013-11-08T19:27:16Z https://community.splunk.com/t5/Getting-Data-In/Entries-from-forwarder-not-appearing-after-upgrading-to-Splunk-6/m-p/135091#M27808 <P>What OS is the laptop running and what Splunk version is the indexer/forwarder your laptop talks to running?</P> Sat, 09 Nov 2013 00:34:31 GMT https://community.splunk.com/t5/Getting-Data-In/Entries-from-forwarder-not-appearing-after-upgrading-to-Splunk-6/m-p/135091#M27808 jtrucks 2013-11-09T00:34:31Z https://community.splunk.com/t5/Getting-Data-In/Entries-from-forwarder-not-appearing-after-upgrading-to-Splunk-6/m-p/135092#M27809 <P>some tracks to check <BR /> - Check the splunkd.log on forwarder to detect any connections errors.<BR /> - make sure that the indexer is still listening to the forwarders (settings &gt; receiving and forwarding, usually port 9997)</P> Sun, 10 Nov 2013 18:38:48 GMT https://community.splunk.com/t5/Getting-Data-In/Entries-from-forwarder-not-appearing-after-upgrading-to-Splunk-6/m-p/135092#M27809 yannK 2013-11-10T18:38:48Z https://community.splunk.com/t5/Getting-Data-In/Entries-from-forwarder-not-appearing-after-upgrading-to-Splunk-6/m-p/135093#M27810 <P>I am actually off from work today, so will have to check this tomorrow. Data is not being received from ANY of the laptops so it seems it must be something on the receiving side. Will check first thing tomorrow morning. Thanks.</P> Mon, 11 Nov 2013 13:39:37 GMT https://community.splunk.com/t5/Getting-Data-In/Entries-from-forwarder-not-appearing-after-upgrading-to-Splunk-6/m-p/135093#M27810 RVDowning 2013-11-11T13:39:37Z https://community.splunk.com/t5/Getting-Data-In/Entries-from-forwarder-not-appearing-after-upgrading-to-Splunk-6/m-p/135094#M27811 <P>Receiving and forwarding shows that receiving is enabled on port 9997. I haven't had a chance to look at the forwarder's logs yet.</P> Tue, 12 Nov 2013 12:52:00 GMT https://community.splunk.com/t5/Getting-Data-In/Entries-from-forwarder-not-appearing-after-upgrading-to-Splunk-6/m-p/135094#M27811 RVDowning 2013-11-12T12:52:00Z https://community.splunk.com/t5/Getting-Data-In/Entries-from-forwarder-not-appearing-after-upgrading-to-Splunk-6/m-p/135095#M27812 <P>Sorry, hadn't seen this response. The indexer is Splunk 6, newly upgraded from Splunk 5 and is on Linux. The forwarders are still Splunk 5 and are on Windows 7.</P> Tue, 12 Nov 2013 13:45:01 GMT https://community.splunk.com/t5/Getting-Data-In/Entries-from-forwarder-not-appearing-after-upgrading-to-Splunk-6/m-p/135095#M27812 RVDowning 2013-11-12T13:45:01Z