All Apps and Add-ons

Stream:stats suddenly stop

golsida
Explorer

Hi,

My customer use splunk UF with stream app. (Splunk 6.4.3, App for stream : 6.6.1)
When I started UF, stream:stats event received successfully, but after few days it cannot received suddenly.
Only this event will not be collected and the other event(captured packet event) will be received normally.
So, when I restart UF, everything is Okay.
streamfwd.log have not any information for stop the stream:stats event.

Would you tell me about the transfer process for stream:stats event?

Tags (1)

dm1
Contributor

Did you end up fixing this issue ?

0 Karma

abroglesc
Explorer

Hi @golsida did you ever solve this? I am running into this same issue currently.

0 Karma

vshcherbakov_sp
Splunk Employee
Splunk Employee

Hi @golsida,

Unlike the regular stream events, stream:stats events get sent to the _internal log. Do you have other events from the _internal log on your UF being forwarded consistently?

0 Karma

abroglesc
Explorer

Hi @golsida did you ever solve this? I am running into this same issue currently.

0 Karma

golsida
Explorer

Hi vshcherbakov,

Yes, other events are forwarded consistently. (ex, splunkd.log, streamfwd.log)
When I restart UF splunk, it sends the events again.
But, after few days( 2~4 days) suddenly stop to send only stream:stats event.
In addition, our customer have 150 UF with stream app and 17~20 sites are forwarded normally.
Is the number of sites a problem?

0 Karma

vshcherbakov_sp
Splunk Employee
Splunk Employee

Hmm.. that sounds strange. I'd suggest opening a support case so that we can review logs/diags/etc.

0 Karma
Get Updates on the Splunk Community!

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...