Deployment Architecture

How forwarder is sending data to indexers? Sudden error in 1 forwarder.

muizash
Path Finder

Actually there were some problems with one of the UF sending data to our indexers suddenly, therefore we had to restart the splunk service. Therefore:
1. I want to know the METHOD(REST, HTTP ETC) by which our 1 of the forwarder is sending data to our indexers.
2. I want to know, where to find the logs that contain the information regarding the connection and other parameters between indexers and forwarder.
3. If you have the splunk query like index.... you are most welcome.

Thankyou

0 Karma
1 Solution

ivanreis
Builder

Question 1 : this command will show what at the inputs that is being monitor
splunk _internal call /admin/inputstatus/TailingProcessor:FileStatus
In general, there is an input configuration to monitor the log files.

Question 2: Splunk create the logs under
/$splunk_home/var/log/splunk

Question 3 : There are some queries here
https://docs.splunk.com/Documentation/Splunk/6.5.1/Troubleshooting/Cantfinddata#Are_you_using_forwar...

for further information, read this post : https://answers.splunk.com/answers/62908/universal-forwarder-not-load-balancing-to-indexers.html

View solution in original post

0 Karma

ivanreis
Builder

Question 1 : this command will show what at the inputs that is being monitor
splunk _internal call /admin/inputstatus/TailingProcessor:FileStatus
In general, there is an input configuration to monitor the log files.

Question 2: Splunk create the logs under
/$splunk_home/var/log/splunk

Question 3 : There are some queries here
https://docs.splunk.com/Documentation/Splunk/6.5.1/Troubleshooting/Cantfinddata#Are_you_using_forwar...

for further information, read this post : https://answers.splunk.com/answers/62908/universal-forwarder-not-load-balancing-to-indexers.html

View solution in original post

0 Karma

muizash
Path Finder

@ivanreis Could you please elaborate on point 1. Where to run command and other details?

0 Karma

ivanreis
Builder
  1. login to the source server where the UF client is installed 2.Under path /splunkforwarder/bin/splunk _internal call /admin/inputstatus/TailingProcessor:FileStatus this will list all inputs on the xml file format on your screen and you are able to see all the inputs that splunk is monitoring

Other option, run the step 1 and run this command ./splunk list monitor, this is also listed all the inputs that are being monitoring

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!