How can i check that the forwarders are sending the logs correctly? I have the following error in my logs:
"eventType=connect_fail" in metrics.log
metrics.log:12-17-2014 09:38:48.529 +0100 INFO StatusMgr - destHost=10.26.XX.XX, destIp=10.26.XX.XX, destPort=9997, eventType=connect_fail, publisher=tcpout, sourcePort=8089, statusee=TcpOutputProcessor
This event produce that the los are not been sending correctly, them i need know if any option in the program execution can check if splunk is sending or not the data to the server.
And, can i resolve this issue in the configuration with some parameter? This issue only appear in determinate times isn't fixed.
Thanks and regards.
up up up !
I downvoted this post because this did not answer the question. how did you get it working?