Getting Data In

Forwarder Stops sending Data and starts sending once restart is done?

raghu0463
Explorer

Hi, 

multiple Forwarders stops sending data for no reason for every 20 days , but when a restart is done, all starts sending normally. there are no warning or error logs in splunkd either. not sure what's causing the issue.
This issue is happening on same forwarders every time. 

Labels (2)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @raghu0463,

maybe the stop sending is from the 1st until the 12nd of the month?

if this is true, please check the timestamp format that probably is in european format (dd/mm/yyyy) and Splunk reads in american format (mm/dd/yyyy).

Ciao.

Giuseppe

0 Karma

isoutamo
SplunkTrust
SplunkTrust

Can you give some more information to us to help you? Like inputs, splunk and os version, have it works earlier etc.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...