Heavy forwarder - Doesn't show/forward events

[rahiparikh]

Hi,

I installed a heavy forwarder on a box and, after a while, I found out that license was not working. ( By mistake, I forgot to change the license type to forwarder and instead ran it under enterprise trial license. )

Indexer name            server-name
License expiration      xxx x, xxxx 4:00:04 AM
Licensed daily volume   1 MB
Volume used today       0 MB (0% of quota)
Warning count           0

So, I contacted splunk and got the reset license and applied it. But, now after reboot I get the same message and my data doesn't show up in indexer. I am sure that they have an established connection because when I check for open ports they have a live connection.

Don't know what problem could be. Any idea? Thanks!

[Simeon · Accepted solution]

It sounds like forwarding is not enabled or working. You should run the following search on the indexer to see if it has even connected:

index=_internal source=*metrics.log tcpin_connections | timechart count by sourceIp

If there are no events, then it is likely your forwarder is not configured properly. you should then examine your outputs.conf settings and inputs.conf settings.