I have a forwarder that appears to be a LWF (SplunkLightForwarder app is enabled) however I am seeing messages about unable to send to output queue parsingQueue. I thought the LWFs didn't do parsing.
How do I tell from Splunk's logs (splunkd.log, others?) that this is definitely a light forwarder and not attempting to parse events, perhaps through an errant setting somewhere?
I checked something out on my "newly" created LWF on Sol.10 x86 with Splunk 4.1.7:
/usr/xpg4/bin/grep -E 'Splunkd starting|controlqueueoutput' $SPLUNK_HOME/var/log/splunk/splunkd.log
03-17-2011 20:31:14.482 INFO loader - Splunkd starting (build 95063).
03-17-2011 20:48:06.492 INFO loader - Splunkd starting (build 95063).
03-17-2011 20:53:55.356 INFO loader - Splunkd starting (build 95063).
03-17-2011 20:58:52.969 INFO loader - Splunkd starting (build 95063).
03-17-2011 20:59:03.029 INFO loader - Instantiated plugin: controlqueueoutputprocessor
Only, LWF shows controlqueueoutputprocessor, regular forwarders dont - means, my last boot was as LWF!
Note: You'd have checked splunk status (splunkwebd isn't running on a LWF), but you asked for the splunkd.log
I checked something out on my "newly" created LWF on Sol.10 x86 with Splunk 4.1.7:
/usr/xpg4/bin/grep -E 'Splunkd starting|controlqueueoutput' $SPLUNK_HOME/var/log/splunk/splunkd.log
03-17-2011 20:31:14.482 INFO loader - Splunkd starting (build 95063).
03-17-2011 20:48:06.492 INFO loader - Splunkd starting (build 95063).
03-17-2011 20:53:55.356 INFO loader - Splunkd starting (build 95063).
03-17-2011 20:58:52.969 INFO loader - Splunkd starting (build 95063).
03-17-2011 20:59:03.029 INFO loader - Instantiated plugin: controlqueueoutputprocessor
Only, LWF shows controlqueueoutputprocessor, regular forwarders dont - means, my last boot was as LWF!
Note: You'd have checked splunk status (splunkwebd isn't running on a LWF), but you asked for the splunkd.log
Great - yes, I control splunkweb independently of LWF sometimes, so I wanted to know from splunkd.log.