Getting Data In

Events on Heavy Forwarder not available on Search Head - IMAP Mailbox

timrich66
Communicator

This issue is primarily related to events ingested via the IMAP Mailbox App

We are running a distributed environment with a HF, 3x indexer and 3x search head (accessed via a VIP).

The install has been carried out as per the README.txt instructions for a distributed environment.

Some events are only appearing when searched for on the HF.  They do not appear when searched for on the SH's.

The results are mixed in that some email events do not appear at all on the SH's and some events may or may not appear.  That is a search on HF returns 11 events.  The same search on SH returns 8 events.

As always, thanks very much for assistance.

 

Labels (2)
0 Karma
1 Solution

timrich66
Communicator

This issue was caused by the setting 'indexAndForward' in outputs.conf causing events to be dropped when the queues were too busy.

The 'indexAndForward' stanza was set to false and the events are now all available via the SH.

View solution in original post

0 Karma

timrich66
Communicator

This issue was caused by the setting 'indexAndForward' in outputs.conf causing events to be dropped when the queues were too busy.

The 'indexAndForward' stanza was set to false and the events are now all available via the SH.

0 Karma

isoutamo
SplunkTrust
SplunkTrust
So you have installed this app to the one HF only and outputs.conf points to your indexers?
Are your indexers and SHs on clusters or are those individuals?
r. Ismo
0 Karma

timrich66
Communicator

Hi @isoutamo 

Yes, $splunkhome/system/local/outputs.conf points to indexers.  

indexers and SHs are clustered

0 Karma
Get Updates on the Splunk Community!

Data Preparation Made Easy: SPL2 for Edge Processor

By now, you may have heard the exciting news that Edge Processor, the easy-to-use Splunk data preparation tool ...

Introducing Edge Processor: Next Gen Data Transformation

We get it - not only can it take a lot of time, money and resources to get data into Splunk, but it also takes ...

Tips & Tricks When Using Ingest Actions

Tune in to learn about:Large scale architecture when using Ingest ActionsRegEx performance considerations ...