topic Re: Splunk Hosts Not Showing Up in Getting Data In

Splunk Hosts Not Showing Up

lmalhoit — Fri, 18 Feb 2011 00:42:58 GMT

I have one Splunk receiver set up and several forwarders (forwarders using free version). About 9 of my hosts are listed under Hosts in the Search panel, but quite a few aren't. They're set up the same way as the 9 that are showing up with my dns name followed by port 9997. It's been a few days and I know there have been events that would be logged in splunk by now.

Any suggestions? This is a mix of Windows 2003 and 2008 servers. I have an eval license which allows for 10GB of data, so it's not a licensing issue.

Thanks in advance!

Re: Splunk Hosts Not Showing Up

Ron_Naken — Fri, 18 Feb 2011 14:04:47 GMT

A license issue wouldn't prevent the data from indexing. You can search the internal index to see if there are isues with those hosts:

index=_internal sourcetype=splunkd

Re: Splunk Hosts Not Showing Up

lmalhoit — Mon, 28 Sep 2020 09:25:05 GMT

I ran the search you asked me to. I'm not seeing anything weird in the logs. I went through quite a bit of it. There was one mention of one of the hosts that seems to be missing and that was about it. It wasn't any kind of error either. This is what is said:
02-21-2011 09:16:58.666 INFO Metrics - group=tcpin_connections, 192.168.100.97:4981:9997, connectionType=cooked, sourcePort=4981, sourceHost=hostname.domain.org, sourceIp=192.168.100.97, destPort=9997, _tcp_Bps=6.39, _tcp_KBps=0.01, _tcp_avg_thruput=0.03, kb=0.19, _tcp_Kprocessed=15513.00, _tcp_eps=0.03

Re: Splunk Hosts Not Showing Up

MuS — Fri, 04 Mar 2011 18:51:09 GMT

Hello lmalhoit

have you tried to connect from one of the 'missing' hosts to your splunk 'receiver', like 'telnet 192.168.100.97 9997' ?

any firewall/ipsec blocking traffic?

Re: Splunk Hosts Not Showing Up

lmalhoit — Mon, 07 Mar 2011 22:52:07 GMT

Yes, I've actually started working on this issue with a splunk tech. Telnet works fine and everything is on the same subnet inside my network...no firewalls in between.
Thanks!