Deployment Architecture

How forwarder is sending data to indexers? Sudden error in 1 forwarder.

muizash
Path Finder

Actually there were some problems with one of the UF sending data to our indexers suddenly, therefore we had to restart the splunk service. Therefore:
1. I want to know the METHOD(REST, HTTP ETC) by which our 1 of the forwarder is sending data to our indexers.
2. I want to know, where to find the logs that contain the information regarding the connection and other parameters between indexers and forwarder.
3. If you have the splunk query like index.... you are most welcome.

Thankyou

0 Karma
1 Solution

ivanreis
Builder

Question 1 : this command will show what at the inputs that is being monitor
splunk _internal call /admin/inputstatus/TailingProcessor:FileStatus
In general, there is an input configuration to monitor the log files.

Question 2: Splunk create the logs under
/$splunk_home/var/log/splunk

Question 3 : There are some queries here
https://docs.splunk.com/Documentation/Splunk/6.5.1/Troubleshooting/Cantfinddata#Are_you_using_forwar...

for further information, read this post : https://answers.splunk.com/answers/62908/universal-forwarder-not-load-balancing-to-indexers.html

View solution in original post

0 Karma

ivanreis
Builder

Question 1 : this command will show what at the inputs that is being monitor
splunk _internal call /admin/inputstatus/TailingProcessor:FileStatus
In general, there is an input configuration to monitor the log files.

Question 2: Splunk create the logs under
/$splunk_home/var/log/splunk

Question 3 : There are some queries here
https://docs.splunk.com/Documentation/Splunk/6.5.1/Troubleshooting/Cantfinddata#Are_you_using_forwar...

for further information, read this post : https://answers.splunk.com/answers/62908/universal-forwarder-not-load-balancing-to-indexers.html

0 Karma

muizash
Path Finder

@ivanreis Could you please elaborate on point 1. Where to run command and other details?

0 Karma

ivanreis
Builder
  1. login to the source server where the UF client is installed 2.Under path /splunkforwarder/bin/splunk _internal call /admin/inputstatus/TailingProcessor:FileStatus this will list all inputs on the xml file format on your screen and you are able to see all the inputs that splunk is monitoring

Other option, run the step 1 and run this command ./splunk list monitor, this is also listed all the inputs that are being monitoring

0 Karma
Get Updates on the Splunk Community!

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...

Reminder! Splunk Love Promo: $25 Visa Gift Card for Your Honest SOAR Review With ...

We recently launched our first Splunk Love Special, and it's gone phenomenally well, so we're doing it again, ...