Entries from forwarder not appearing after upgrading to Splunk 6,.0, may have to restore from backup

[RVDowning]

Any idea why entries from forwarder local logs aren't being forwarded to the server after upgrading to Splunk 6.0. Have restarted the forwarder on the laptop but am still not getting transactions. About to have to restore to 5.x from the backup.

Edited to note that we upgraded one laptop to the v6 forwarder, but it still isn't forwarding so it has to be something on the server/indexer side.

[RVDowning]

Sorry, hadn't seen this response. The indexer is Splunk 6, newly upgraded from Splunk 5 and is on Linux. The forwarders are still Splunk 5 and are on Windows 7.

[yannK]

some tracks to check
- Check the splunkd.log on forwarder to detect any connections errors.
- make sure that the indexer is still listening to the forwarders (settings > receiving and forwarding, usually port 9997)

[RVDowning]

Receiving and forwarding shows that receiving is enabled on port 9997. I haven't had a chance to look at the forwarder's logs yet.

[RVDowning]

I am actually off from work today, so will have to check this tomorrow. Data is not being received from ANY of the laptops so it seems it must be something on the receiving side. Will check first thing tomorrow morning. Thanks.

[jtrucks]

What OS is the laptop running and what Splunk version is the indexer/forwarder your laptop talks to running?