Archive

Forwarder stopped pushing performance data

Explorer

Hi,

I had a completely working setup where forwarder was pushing data to UF successfully but it stopped pushing data a week earlier.
There is no error in splunkd.log which can explain the reason.

How do I fix it?

All other indexes are working fine. It's just that performance counters are not pushed. Registry values are fine.

Tags (1)
0 Karma

Legend

Hi siddharthmis,
only three foolish questions:

  • forwarder time and date are the same of Indexers?
  • did you checked if you're receiving logs in _internal index?
  • surely you checked connection using telnet (telnet indexer_IP 9997).

Bye.
Giuseppe

0 Karma

SplunkTrust
SplunkTrust

Hi siddharthmis,
do you mean forwarder pushed data to another forwarder (UF) ? or forwarder sending data to indexer and now it does not send data anymore?

0 Karma

Explorer

I mean it stopped pushing data to Splunk deployment (indexer)

0 Karma

Splunk Employee
Splunk Employee

Hi siddharthmis, are you using Window Perfmon stanza in the UF ?

0 Karma

Path Finder

version/OS info would help, have you tried restarting from the CLI?

0 Karma

Explorer

Yes but in Vain

0 Karma