topic Re: How to troubleshoot the Universal Forwarder when it is not sending events to the indexer? in Getting Data In

How to troubleshoot the Universal Forwarder when it is not sending events to the indexer?

sarthakb — Mon, 19 Dec 2016 16:37:18 GMT

We have a existing infrastructure of Splunk where events are passed from multiple Linux boxes to Splunk indexers.

We recently have installed Splunk forwarder in a Windows box. When we search in Splunk using that host name, we don't see the events.

We have checked the logs with the following observation
- It is picking up new monitor config.
- No error is reported in Splunkd.log

Can you please share the troubleshooting steps for the forwarder? Can forwarder log files help us pin point - if forwarder at all sending the events to Indexer?

Re: How to troubleshoot the Universal Forwarder when it is not sending events to the indexer?

skoelpin — Mon, 19 Dec 2016 16:43:17 GMT

So the data is being forwarded correctly to your indexer(s) but you cannot find the host when searching?

Can you check the outputs.conf on the forwarder to verify you have the correct hostname there?

C:\SPLUNK_HOME\etc\system\local\outputs.conf

Re: How to troubleshoot the Universal Forwarder when it is not sending events to the indexer?

sarthakb — Mon, 19 Dec 2016 16:48:15 GMT

Hi, Thanks for the quick reply.

I dont know if the data is being forwarded correctly. I am looking for guidance to confirm that.

regards,
Sarthak

Re: How to troubleshoot the Universal Forwarder when it is not sending events to the indexer?

ddrillic — Mon, 19 Dec 2016 16:55:08 GMT

Good place to start at I can't find my data!

Re: How to troubleshoot the Universal Forwarder when it is not sending events to the indexer?

chrishartsock — Mon, 19 Dec 2016 17:03:14 GMT

Along the lines of skoelpin's comment, it sounds like there may be an issue sending from the UF to the indexer. Can you see in the splunkd.log on the UF that the UF is successfully connecting to the indexer?

Re: How to troubleshoot the Universal Forwarder when it is not sending events to the indexer?

nekbote — Mon, 19 Dec 2016 18:31:28 GMT

@ sarthakb refer to below thread...you can refer to my answer there to get some tips and also others answers as well

https://answers.splunk.com/answers/5590/could-not-send-data-to-the-output-queue.html#answer-466859

As @chrishartsoc mentioned...your starting point is checking splunkd and metrics log on the forwarder.

Re: How to troubleshoot the Universal Forwarder when it is not sending events to the indexer?

sarthakb — Mon, 19 Dec 2016 20:51:44 GMT

Interesting Observation - The forwarder is able to send data to indexer in each line does not starts with a date time.

e.g

12/13/2016 12:45:77.907 -0500 Some content

The above line fails

12/13/2016 Some content

Above line works

Seems like forwarder is trying to parse date time.

Is there a way to forcefully tell forwarder not to parse datetime?