Deployment Architecture

Could anyone help with the process of tracking down how this data is being brought into that index?

_lostpackets
Engager

I upgraded the Heavy Forwarders in my environment to Splunk enterprise 8.2.5 and figured out today on the day of upgrade that I stopped receiving data in one of my indexes. 

 

By searching  events in the index prior to my upgrade, I was able to figure out that the host the events are being received from is running Windows 2008 R2 (running a Splunk UF version 7.2.2) - that may have something to do with this. I am trying to further troubleshoot and figure out how the data is being brought into that index but I am not a seasoned splunk veteran by any means. 

 

Searching around for answers to this has been a bit convoluted. Could anyone help me through the process of tracking down how that data is being brought into that index? I'm thinking this may have something to do with lack of compatibility for HTTPS from the host to the heavy forwarder. Any help or guidance is much appreciated.

Labels (2)
0 Karma
1 Solution

_lostpackets
Engager

 Update: I was able to triage the issue and isolated it to the DB connect app that was setup to pull data into the aforementioned index. 

I had to update the DB connect app on my deployment server and then re-enter credentials for the account that was setup to connect to the Database server via NTLM. This fixed the issue and I began to receive data back into the index.

View solution in original post

0 Karma

_lostpackets
Engager

 Update: I was able to triage the issue and isolated it to the DB connect app that was setup to pull data into the aforementioned index. 

I had to update the DB connect app on my deployment server and then re-enter credentials for the account that was setup to connect to the Database server via NTLM. This fixed the issue and I began to receive data back into the index.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...