Deployment Architecture

Data not coming in from some forwarders

RVDowning
Contributor

I used the deployment monitor to create a new server class and added 11 servers to it. I created an app that just targets a couple of windows performance items. However, I only get data from 4 of the 11 forwarders.

When I look at the server class in the deployment monitor it shows all 11 servers, however on the 7 from which I am getting no data the client name just shows "deploymentClient" whereas on the others there are identifiers such as "C9D11F05-A6AF-4DFC-B003-58174CB478A6"

I don't seem to be able to see anything different between the servers from which I am getting data from the servers from which I am not getting data. Any ideas?

0 Karma
1 Solution

RVDowning
Contributor

Pushed out the latest and greatest, 6.2.1 and all is well.

View solution in original post

0 Karma

RVDowning
Contributor

Pushed out the latest and greatest, 6.2.1 and all is well.

0 Karma

RVDowning
Contributor

Think I finally found out what the issue is. The forwarders that are not sending in performance data are version 4.2.2 and the ones that are sending in that data are 6.0.2. So, I'll push out the newest forwarders and then report back.

0 Karma

RVDowning
Contributor

Forgot to mention that I did restart the forwarder on one of the servers from which no performance data is being retrieved but it made no difference. By the way, these forwarders continue to send in other unrelated data, so the forwarder is working fine. The issue is just with some servers in this new server class.

0 Karma

RVDowning
Contributor

Crickets. 😞

Still not getting data from those other servers and still can find no difference between those that are and those that are not sending in data.

The app-name directory does exist (under the /etc/apps directory) on each machine and the content of the inputs.conf file is identical on each. The content is as follows:

[perfmon://CPU]
counters = *
disabled = 0
instances = _Total
interval = 60
object = Processor
index = perfmon

[perfmon://memory]
counters = *
disabled = 0
instances = *
interval = 60
object = Memory
index = perfmon

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...