Any idea why entries from forwarder local logs aren't being forwarded to the server after upgrading to Splunk 6.0. Have restarted the forwarder on the laptop but am still not getting transactions. About to have to restore to 5.x from the backup.
Edited to note that we upgraded one laptop to the v6 forwarder, but it still isn't forwarding so it has to be something on the server/indexer side.
some tracks to check
- Check the splunkd.log on forwarder to detect any connections errors.
- make sure that the indexer is still listening to the forwarders (settings > receiving and forwarding, usually port 9997)
I am actually off from work today, so will have to check this tomorrow. Data is not being received from ANY of the laptops so it seems it must be something on the receiving side. Will check first thing tomorrow morning. Thanks.