Getting Data In

Deployment monitor is seeing tcp input as a legacy forwarder

Starlette
Contributor

I have a tcp port as input ( and 2 devices are sending data) and its showing up in de deployment monitor (4.2 centos 5.5) as (pre 4.2) legacy forwarders. Is this supposed to be? think its a bit misguided?

thanks

Tags (2)
0 Karma

Edub
Explorer

I noticed the same thing. The search in the deployment monitor app is labeling anything in the metrics log that is "raw" or "rawSSL" as "Legacy Forwarder".

Here is a small part of the search string that causes that:

connectionType=="raw" or connectionType=="rawSSL","Legacy Forwarder")

I guess the proper question is why Splunk sees that data as "raw". I'm think it is because it is a TCP input and not "cooked" by a forwarder. My guess is that this is a bug in that specific search being too broad with its definition of "Legacy Forwarder".

All speculation and guesses based on about 20min of research...

You can find that search by going to the Forwarders screen in the Deployment Monitor App and then opening the jobs screen (upper right link). It should be the top search.

E.

ephemeric
Contributor

I have the same issue. Noticed this after forwarding metrics.log from our heavy forwarder to an indexer. There are about twenty raw TCP inputs into this heavy forwarder and for some reason it sees only one connectionType=raw in there as a Legacy Forwarder... I'm lost.

0 Karma
Get Updates on the Splunk Community!

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...