topic Re: Splunk Heavy Forwarder Problem in Installation

Splunk Heavy Forwarder Problem

Darsh1561 — Tue, 24 Jan 2023 13:38:17 GMT

Hello Community,

I would like to inquire about some issues I am facing while setting up a heavy forwarder in splunk. Please take a look at the below issues :-

1) Hosts are visible in splunk but all of them are not forwarding their logs to the indexer.

2) Linux server are not able to forward logs to the indexer.

3) Some host are able to forward their logs to indexer post a modification in their universal forwarder file manually, but it takes an hour or so before they forward their logs.

4) The most recently added do not show their logs in real time i.e. when a time frame recently added devices should logs in last 4 hours or 60 minutes but they do show only post 24 hours time filter.

Thanks in advance.

Re: Splunk Heavy Forwarder Problem

gcusello — Tue, 24 Jan 2023 16:21:14 GMT

Hi @Darsh1561m,

please detail your questions:

1) Hosts are visible in splunk but all of them are not forwarding their logs to the indexer.

you mean that you see some hosts in the Deployment Server but that you don't see their logs or what else?

2) Linux server are not able to forward logs to the indexer.

are you meaning that all your Linux servers don't sed logs?

I suppose that you already configured:

your indexers and your Heavy Forwarders to receive logs,
your Forwarders to send logs to the Indexers or to Heavy Forwarders,

how did you do this?

did you checked that the firewall routes between Forwarders and Indexers and Heavy Forwarders are open?

What's you architecture?

3) Some host are able to forward their logs to indexer post a modification in their universal forwarder file manually, but it takes an hour or so before they forward their logs.

Which local configuration did you do?

are you using a Deployment server?

have you followed the instructions at https://www.splunk.com/en_us/resources/videos/getting-data-in-with-forwarders.html or https://docs.splunk.com/Documentation/Splunk/9.0.3/Data/Usingforwardingagents or https://docs.splunk.com/Documentation/Splunk/9.0.3/Forwarding/Aboutforwardingandreceivingdata ?

4) The most recently added do not show their logs in real time i.e. when a time frame recently added devices should logs in last 4 hours or 60 minutes but they do show only post 24 hours time filter.

did you checked the timestamp of these events, is it correct?

Ciao.

Giuseppe

Re: Splunk Heavy Forwarder Problem

PickleRick — Tue, 24 Jan 2023 16:25:12 GMT

You seem to have multiple separate problems here. So isolate them and try to troubleshoot one by one.

First question is what architecture do you have. Second - what _is_ working. Third - what change did you introduce lately. What was the expected behaviour after this change and what is the actual observed behaviour.

Don't try to do multiple things at once and then try to pinpoint why something is not working as expected because this way you can't track cause-effect relationships.

Re: Splunk Heavy Forwarder Problem

Darsh1561 — Sat, 28 Jan 2023 15:44:00 GMT

Thanks for your input.

Re: Splunk Heavy Forwarder Problem

aad — Tue, 07 Feb 2023 05:22:47 GMT

Thank you! that make sense

Re: Splunk Heavy Forwarder Problem

gcusello — Tue, 07 Feb 2023 07:30:15 GMT

Hi at all,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated by all the contributors 😉