topic Splunk Forwarder with DB Connect : connection not closed with Splunk Indexer in Getting Data In

Splunk Forwarder with DB Connect : connection not closed with Splunk Indexer

mbennani3492 — Mon, 18 Jun 2018 13:52:04 GMT

I am using Splunk Heavy Forwader with DB Connect to forward data to a Splunk Indexer instance.
Although the HF is not forwarding any data, the connection is still established between the HF and the indexer. I'm talking about a connection that hasn't been closed for more than 3 days with no data sent!
Is anyone having the same problem ? I could use some help, thanks in advance.

Re: Splunk Forwarder with DB Connect : connection not closed with Splunk Indexer

jtacy — Mon, 18 Jun 2018 23:52:33 GMT

That sounds appropriate; forwarders, both universal and heavy, will always try to have a connection open to an indexer. If you have just one indexer, I believe it will keep a single connection open until something interrupts that connection. The connection is probably not idle, either; the HF is probably forwarding data about its internal operation and that data should be in the _internal index on your indexer.

Re: Splunk Forwarder with DB Connect : connection not closed with Splunk Indexer

mbennani3492 — Tue, 19 Jun 2018 12:28:18 GMT

Thanks for your answer.
So you are saying that it is normal as long as the HF is sending its internal data to my indexer.
Then how can I make him stop, and send only the data i want it to send ?