Getting Data In

Forwarder Stops sending Data and starts sending once restart is done?

raghu0463
Explorer

Hi, 

multiple Forwarders stops sending data for no reason for every 20 days , but when a restart is done, all starts sending normally. there are no warning or error logs in splunkd either. not sure what's causing the issue.
This issue is happening on same forwarders every time. 

Labels (2)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @raghu0463,

maybe the stop sending is from the 1st until the 12nd of the month?

if this is true, please check the timestamp format that probably is in european format (dd/mm/yyyy) and Splunk reads in american format (mm/dd/yyyy).

Ciao.

Giuseppe

0 Karma

isoutamo
SplunkTrust
SplunkTrust

Can you give some more information to us to help you? Like inputs, splunk and os version, have it works earlier etc.

0 Karma
Get Updates on the Splunk Community!

Modern way of developing distributed application using OTel

Recently, I had the opportunity to work on a complex microservice using Spring boot and Quarkus to develop a ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had 3 releases of new security content via the Enterprise Security ...

Archived Metrics Now Available for APAC and EMEA realms

We’re excited to announce the launch of Archived Metrics in Splunk Infrastructure Monitoring for our customers ...