How forwarder is sending data to indexers? Sudden error in 1 forwarder.

[muizash]

Actually there were some problems with one of the UF sending data to our indexers suddenly, therefore we had to restart the splunk service. Therefore:
1. I want to know the METHOD(REST, HTTP ETC) by which our 1 of the forwarder is sending data to our indexers.
2. I want to know, where to find the logs that contain the information regarding the connection and other parameters between indexers and forwarder.
3. If you have the splunk query like index.... you are most welcome.

Thankyou

[ivanreis · Accepted solution]

Question 1 : this command will show what at the inputs that is being monitor
splunk _internal call /admin/inputstatus/TailingProcessor:FileStatus
In general, there is an input configuration to monitor the log files.

Question 2: Splunk create the logs under
/$splunk_home/var/log/splunk

Question 3 : There are some queries here
https://docs.splunk.com/Documentation/Splunk/6.5.1/Troubleshooting/Cantfinddata#Are_you_using_forwar...

for further information, read this post : https://answers.splunk.com/answers/62908/universal-forwarder-not-load-balancing-to-indexers.html

[muizash]

@ivanreis Could you please elaborate on point 1. Where to run command and other details?

[ivanreis]

1. login to the source server where the UF client is installed 2.Under path /splunkforwarder/bin/splunk _internal call /admin/inputstatus/TailingProcessor:FileStatus this will list all inputs on the xml file format on your screen and you are able to see all the inputs that splunk is monitoring

Other option, run the step 1 and run this command ./splunk list monitor, this is also listed all the inputs that are being monitoring