Forwarder stopped pushing performance data

[siddharthmis]

Hi,

I had a completely working setup where forwarder was pushing data to UF successfully but it stopped pushing data a week earlier.
There is no error in splunkd.log which can explain the reason.

How do I fix it?

All other indexes are working fine. It's just that performance counters are not pushed. Registry values are fine.

[gcusello]

Hi siddharthmis,
only three foolish questions:

• forwarder time and date are the same of Indexers?
• did you checked if you're receiving logs in _internal index?
• surely you checked connection using telnet (telnet indexer_IP 9997).

Bye.
Giuseppe

[adonio]

Hi siddharthmis,
do you mean forwarder pushed data to another forwarder (UF) ? or forwarder sending data to indexer and now it does not send data anymore?

[siddharthmis]

I mean it stopped pushing data to Splunk deployment (indexer)

[tlam_splunk]

Hi siddharthmis, are you using Window Perfmon stanza in the UF ?

[ppeterson]

version/OS info would help, have you tried restarting from the CLI?

[siddharthmis]

Yes but in Vain