Deployment Architecture

Data not coming in from some forwarders

RVDowning
Contributor

I used the deployment monitor to create a new server class and added 11 servers to it. I created an app that just targets a couple of windows performance items. However, I only get data from 4 of the 11 forwarders.

When I look at the server class in the deployment monitor it shows all 11 servers, however on the 7 from which I am getting no data the client name just shows "deploymentClient" whereas on the others there are identifiers such as "C9D11F05-A6AF-4DFC-B003-58174CB478A6"

I don't seem to be able to see anything different between the servers from which I am getting data from the servers from which I am not getting data. Any ideas?

0 Karma
1 Solution

RVDowning
Contributor

Pushed out the latest and greatest, 6.2.1 and all is well.

View solution in original post

0 Karma

RVDowning
Contributor

Pushed out the latest and greatest, 6.2.1 and all is well.

0 Karma

RVDowning
Contributor

Think I finally found out what the issue is. The forwarders that are not sending in performance data are version 4.2.2 and the ones that are sending in that data are 6.0.2. So, I'll push out the newest forwarders and then report back.

0 Karma

RVDowning
Contributor

Forgot to mention that I did restart the forwarder on one of the servers from which no performance data is being retrieved but it made no difference. By the way, these forwarders continue to send in other unrelated data, so the forwarder is working fine. The issue is just with some servers in this new server class.

0 Karma

RVDowning
Contributor

Crickets. 😞

Still not getting data from those other servers and still can find no difference between those that are and those that are not sending in data.

The app-name directory does exist (under the /etc/apps directory) on each machine and the content of the inputs.conf file is identical on each. The content is as follows:

[perfmon://CPU]
counters = *
disabled = 0
instances = _Total
interval = 60
object = Processor
index = perfmon

[perfmon://memory]
counters = *
disabled = 0
instances = *
interval = 60
object = Memory
index = perfmon

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...