topic Re: Splunk list monitor, hanging in Getting Data In

Splunk list monitor, hanging

perfecto25 — Thu, 06 Apr 2017 15:07:07 GMT

on the forwarder (centos 6.8), running 'splunk list monitor' simply hangs. No error msg or output,

[root@njo2/opt/splunkforwarder/etc/apps]# /opt/splunkforwarder/bin/splunk version
Splunk Universal Forwarder 6.5.1 (build f74036626f0c)

[root@njo2 /opt/splunkforwarder/etc/apps]# /opt/splunkforwarder/bin/splunk list monitor

..hangs

Im tryign to troubleshoot the forwarder, its not sending any log info to the indexer

Re: Splunk list monitor, hanging

adonio — Thu, 06 Apr 2017 17:01:10 GMT

Hello perfecto25
first check if splunk is running /opt/splunkforwarder/bin/splunk status
i tested and splunk version command works when splunk is down but the list monitor command hangs
if its down, start splunk /opt/splunkforwarder/bin/splunk start
now when its up, run the list monitor command
hope it helps

Re: Splunk list monitor, hanging

perfecto25 — Thu, 06 Apr 2017 17:09:32 GMT

yes, its running, still hangs, nothing in logs

[root@njo1 /opt/splunkforwarder/var/log/splunk]# /opt/splunkforwarder/bin/splunk status
splunkd is running (PID: 15929).
splunk helpers are running (PIDs: 15937).
[root@njo1 /opt/splunkforwarder/var/log/splunk]# /opt/splunkforwarder/bin/splunk list monitor

^C^
[root@njo1 /opt/splunkforwarder/var/log/splunk]#
[root@njo1 /opt/splunkforwarder/var/log/splunk]# /opt/splunkforwarder/bin/splunk start
The splunk daemon (splunkd) is already running. [FAILED]

Re: Splunk list monitor, hanging

adonio — Thu, 06 Apr 2017 17:39:08 GMT

can you try and restart the forwarder?

Re: Splunk list monitor, hanging

perfecto25 — Thu, 06 Apr 2017 17:45:30 GMT

tried that, no dice

All preliminary checks passed.

Starting splunk server daemon (splunkd)...

Done
[ OK ]
[root@njo1 /opt/splunkforwarder/var/log/splunk]# /opt/splunkforwarder/bin/splunk list monitor
...

Re: Splunk list monitor, hanging

adonio — Thu, 06 Apr 2017 17:51:12 GMT

very odd,
does the install of forwarder was smooth? does the forwarder version match the OS?
do you have any inputs configured already on forwarder?