Getting Data In

2 of my indexer are configured but inactive state is showing . The data is not going to ingest in 2 indexers.

Hemant93
Loves-to-Learn Lots

Two of my indexer is not working they are not receiving data from Universal forwarder.
when i run the command ./splunk display listen so it shows 9998 is listening and ./splunk list forward-server
gives the below result.

Active forwards:
10.246.250.154:9998 (ssl)

Configured but inactive forwards: 10.246.250.155:9998 10.246.250.156:9998

 

Let me know what i can do to activate the other two indexers

Labels (2)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Is the forwarder logging any errors about failing to connect to the indexers?

---
If this reply helps you, Karma would be appreciated.
0 Karma

Hemant93
Loves-to-Learn Lots

@richgalloway 

we are getting these below error although splunk is up and running and configuration is also good




0-03-2023 08:04:43.963 -0400 ERROR TcpOutputFd [5866 TcpOutEloop] - Connection to host=10.246.250.154:9998 failed
 
10-04-2023 08:02:47.688 -0400 WARN  TcpOutputFd [3703313 TcpOutEloop] - Connect to 10.246.250.155:9998 failed. No route to host
10-04-2023 08:02:47.750 -0400 WARN  TcpOutputFd [3703313 TcpOutEloop] - Connect to 10.246.250.156:9998 failed. No route to host
0 Karma

PickleRick
SplunkTrust
SplunkTrust

This kind of errors typically show problems either on the network level (some firewall in the middle not allowing traffic from the UF to the indexers) or the host firewall on the indexer not allowing the incoming traffic.

Hemant93
Loves-to-Learn Lots

we are getting these below error although splunk is up and running and configuration is also good




0-03-2023 08:04:43.963 -0400 ERROR TcpOutputFd [5866 TcpOutEloop] - Connection to host=10.246.250.154:9998 failed
 
10-04-2023 08:02:47.688 -0400 WARN  TcpOutputFd [3703313 TcpOutEloop] - Connect to 10.246.250.155:9998 failed. No route to host
10-04-2023 08:02:47.750 -0400 WARN  TcpOutputFd [3703313 TcpOutEloop] - Connect to 10.246.250.156:9998 failed. No route to host
0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...