topic Re: Heavy Forwarder losing data when forwarding data from HTTP Event Collector in Getting Data In

Heavy Forwarder losing data when forwarding data from HTTP Event Collector

simpkins1958 — Thu, 24 Aug 2017 20:05:04 GMT

We are developing Splunk dashboards. We have a Splunk enterprise server that is receiving HTTP event collector data form our clients. We have setup the server that receives the HEC information as a Heavy Forwarder that indexes locally and then forwards data to several other Splunk servers that we are using for development.

The servers we are forwarding to are losing events.

source=netmotion | stats count

for the same time span is returning significantly different count values. 13,089 from the splunk server receiving the HEC events, and 5,713 from the Splunk server we are forwarding to.

Why is this happening?

Re: Heavy Forwarder losing data when forwarding data from HTTP Event Collector

gcusello — Fri, 25 Aug 2017 08:31:35 GMT

Hi simpkins1958,
can you install a Forwarder on the target systems?
If you can, use a Forwarder to ingest and send logs to the Indexer, to be safer about log losing.
Bye.
Giuseppe

Re: Heavy Forwarder losing data when forwarding data from HTTP Event Collector

simpkins1958 — Fri, 25 Aug 2017 14:52:43 GMT

We are not getting data from log files. We are getting data from our clients through the Splunk HTTP Event Collector.

Re: Heavy Forwarder losing data when forwarding data from HTTP Event Collector

simpkins1958 — Fri, 25 Aug 2017 20:52:58 GMT

We had outputs.conf configured wrong. We were auto load balancing to the three servers.

Re: Heavy Forwarder losing data when forwarding data from HTTP Event Collector

lfedak_splunk — Fri, 25 Aug 2017 20:57:26 GMT

@simpkins1958, did that resolve the issue? If so I will close the question.

Re: Heavy Forwarder losing data when forwarding data from HTTP Event Collector

simpkins1958 — Fri, 25 Aug 2017 21:09:22 GMT

Yes. User error...

Re: Heavy Forwarder losing data when forwarding data from HTTP Event Collector

gcusello — Sat, 26 Aug 2017 07:56:50 GMT

I understand, but if you can have a forwarder on the target server you could take logs from files, so you optimize log transmission and you're safer about log losing.
Otherwise, you should check if there could be a network problem during transmission.
I usually prefer to use Forwarders than HPPT Collector for the abome reasons.
Bye.
Giuseppe