Deployment monitor is seeing tcp input as a legacy forwarder

[Starlette]

I have a tcp port as input ( and 2 devices are sending data) and its showing up in de deployment monitor (4.2 centos 5.5) as (pre 4.2) legacy forwarders. Is this supposed to be? think its a bit misguided?

thanks

[Edub]

I noticed the same thing. The search in the deployment monitor app is labeling anything in the metrics log that is "raw" or "rawSSL" as "Legacy Forwarder".

Here is a small part of the search string that causes that:

connectionType=="raw" or connectionType=="rawSSL","Legacy Forwarder")

I guess the proper question is why Splunk sees that data as "raw". I'm think it is because it is a TCP input and not "cooked" by a forwarder. My guess is that this is a bug in that specific search being too broad with its definition of "Legacy Forwarder".

All speculation and guesses based on about 20min of research...

You can find that search by going to the Forwarders screen in the Deployment Monitor App and then opening the jobs screen (upper right link). It should be the top search.

E.

[ephemeric]

I have the same issue. Noticed this after forwarding metrics.log from our heavy forwarder to an indexer. There are about twenty raw TCP inputs into this heavy forwarder and for some reason it sees only one connectionType=raw in there as a Legacy Forwarder... I'm lost.