Deployment Architecture

Unable to get data from splunk forwarder consistently.

kamal_jagga
Contributor

Hi,

My splunk forwarder is working in-consistently and is not forwarding data regularly. When i restart the forwarder it immediately sends all the data till that time. And then does not forward it till the next restart.

Kindly advise.

Tags (1)
0 Karma
1 Solution

kamal_jagga
Contributor

It seems that some one had removed the entries from transform.conf and props.conf for my index. I updated the entries and the issue got fixed.

View solution in original post

0 Karma

kamal_jagga
Contributor

I have researched and found 2 possible solutions for this.

  1. Too much processing is happening on forwarder. Removing some filtering from transform.conf should solve the issue.
  2. Install another universal forwarder instance on server on which forwarder is installed.
0 Karma

kamal_jagga
Contributor

It seems that some one had removed the entries from transform.conf and props.conf for my index. I updated the entries and the issue got fixed.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Check $SPLUNK_HOME/var/log/splunkd.log on the forwarder - or in Splunk if it managed to forward it - for any messages.

0 Karma

woodcock
Esteemed Legend

I have seen this happen because the forwarder is sorting through too many directories and files If you have inputs.conf like this:

[monitor:///somedir/logs/]
index=myindex
sourcetype=mysourcetype

You need to add this stuff, too, to limit the number of files that Splunk has to examine and the number of directories it has to traverse:

recursive = false
whitelist = *.log
blacklist = *badfile*.log

Also if you are using /.../ in the path of the stanza header, try to be more explicit, even if all you can do is change to /*/

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...