Deployment Architecture

Data not coming in from some forwarders

RVDowning
Contributor

I used the deployment monitor to create a new server class and added 11 servers to it. I created an app that just targets a couple of windows performance items. However, I only get data from 4 of the 11 forwarders.

When I look at the server class in the deployment monitor it shows all 11 servers, however on the 7 from which I am getting no data the client name just shows "deploymentClient" whereas on the others there are identifiers such as "C9D11F05-A6AF-4DFC-B003-58174CB478A6"

I don't seem to be able to see anything different between the servers from which I am getting data from the servers from which I am not getting data. Any ideas?

0 Karma
1 Solution

RVDowning
Contributor

Pushed out the latest and greatest, 6.2.1 and all is well.

View solution in original post

0 Karma

RVDowning
Contributor

Pushed out the latest and greatest, 6.2.1 and all is well.

0 Karma

RVDowning
Contributor

Think I finally found out what the issue is. The forwarders that are not sending in performance data are version 4.2.2 and the ones that are sending in that data are 6.0.2. So, I'll push out the newest forwarders and then report back.

0 Karma

RVDowning
Contributor

Forgot to mention that I did restart the forwarder on one of the servers from which no performance data is being retrieved but it made no difference. By the way, these forwarders continue to send in other unrelated data, so the forwarder is working fine. The issue is just with some servers in this new server class.

0 Karma

RVDowning
Contributor

Crickets. 😞

Still not getting data from those other servers and still can find no difference between those that are and those that are not sending in data.

The app-name directory does exist (under the /etc/apps directory) on each machine and the content of the inputs.conf file is identical on each. The content is as follows:

[perfmon://CPU]
counters = *
disabled = 0
instances = _Total
interval = 60
object = Processor
index = perfmon

[perfmon://memory]
counters = *
disabled = 0
instances = *
interval = 60
object = Memory
index = perfmon

0 Karma
Get Updates on the Splunk Community!

Earn a $35 Gift Card for Answering our Splunk Admins & App Developer Survey

Survey for Splunk Admins and App Developers is open now! | Earn a $35 gift card!      Hello there,  Splunk ...

Continuing Innovation & New Integrations Unlock Full Stack Observability For Your ...

You’ve probably heard the latest about AppDynamics joining the Splunk Observability portfolio, deepening our ...

Monitoring Amazon Elastic Kubernetes Service (EKS)

As we’ve seen, integrating Kubernetes environments with Splunk Observability Cloud is a quick and easy way to ...