Getting Data In

Entries from forwarder not appearing after upgrading to Splunk 6,.0, may have to restore from backup

Contributor

Any idea why entries from forwarder local logs aren't being forwarded to the server after upgrading to Splunk 6.0. Have restarted the forwarder on the laptop but am still not getting transactions. About to have to restore to 5.x from the backup.

Edited to note that we upgraded one laptop to the v6 forwarder, but it still isn't forwarding so it has to be something on the server/indexer side.

0 Karma

Contributor

Sorry, hadn't seen this response. The indexer is Splunk 6, newly upgraded from Splunk 5 and is on Linux. The forwarders are still Splunk 5 and are on Windows 7.

0 Karma

Splunk Employee
Splunk Employee

some tracks to check
- Check the splunkd.log on forwarder to detect any connections errors.
- make sure that the indexer is still listening to the forwarders (settings > receiving and forwarding, usually port 9997)

0 Karma

Contributor

Receiving and forwarding shows that receiving is enabled on port 9997. I haven't had a chance to look at the forwarder's logs yet.

0 Karma

Contributor

I am actually off from work today, so will have to check this tomorrow. Data is not being received from ANY of the laptops so it seems it must be something on the receiving side. Will check first thing tomorrow morning. Thanks.

0 Karma

Splunk Employee
Splunk Employee

What OS is the laptop running and what Splunk version is the indexer/forwarder your laptop talks to running?

0 Karma
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes and swag!