Deployment Architecture

Forwarder stopped pushing performance data

siddharthmis
Explorer

Hi,

I had a completely working setup where forwarder was pushing data to UF successfully but it stopped pushing data a week earlier.
There is no error in splunkd.log which can explain the reason.

How do I fix it?

All other indexes are working fine. It's just that performance counters are not pushed. Registry values are fine.

Tags (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi siddharthmis,
only three foolish questions:

  • forwarder time and date are the same of Indexers?
  • did you checked if you're receiving logs in _internal index?
  • surely you checked connection using telnet (telnet indexer_IP 9997).

Bye.
Giuseppe

0 Karma

adonio
Ultra Champion

Hi siddharthmis,
do you mean forwarder pushed data to another forwarder (UF) ? or forwarder sending data to indexer and now it does not send data anymore?

0 Karma

siddharthmis
Explorer

I mean it stopped pushing data to Splunk deployment (indexer)

0 Karma

tlam_splunk
Splunk Employee
Splunk Employee

Hi siddharthmis, are you using Window Perfmon stanza in the UF ?

0 Karma

ppeterson
Path Finder

version/OS info would help, have you tried restarting from the CLI?

0 Karma

siddharthmis
Explorer

Yes but in Vain

0 Karma
Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...