Deployment Architecture

Why some of our universal forwarder intermittently stops forwarding logs?

dantimola
Communicator

Hi All,

Good day, would like to seek for help regarding on our universal forwarders. Some of our sources (universal forwarder) intermittently stops forwarding logs. I don't know why, firewall definition is intact, if you telnet splunk ports from the sources, the results are good. However, when checking splunkd.log, Cooked Connection, Raw Connection, Ping connection and Connection TIme out can be seen. Please help. Thanks.

Universal Forwarder Versions are:
6.2.6, 6.4.0

Splunk Enterprise Infra and versions:
6 Indexers: 6.6.1
3 Heavy Forwarders: 6.6.1
2 SH: 6.6.1

Regards,
Dan

0 Karma

dantimola
Communicator

@dantimola will give you +30 Karma points for answering this question.

0 Karma

dantimola
Communicator

I've conducted health check on our infra. Maybe this can help. Looks like the event-processing queues is having an issue. How can I optimize/resolve this? Thanks.

alt text

0 Karma
Get Updates on the Splunk Community!

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...

SignalFlow: What? Why? How?

What is SignalFlow? Splunk Observability Cloud’s analytics engine, SignalFlow, opens up a world of in-depth ...

Federated Search for Amazon S3 | Key Use Cases to Streamline Compliance Workflows

Modern business operations are supported by data compliance. As regulations evolve, organizations must ...