Getting Data In

How to troubleshoot the Universal Forwarder when it is not sending events to the indexer?

sarthakb
Explorer

We have a existing infrastructure of Splunk where events are passed from multiple Linux boxes to Splunk indexers.

We recently have installed Splunk forwarder in a Windows box. When we search in Splunk using that host name, we don't see the events.

We have checked the logs with the following observation
- It is picking up new monitor config.
- No error is reported in Splunkd.log

Can you please share the troubleshooting steps for the forwarder? Can forwarder log files help us pin point - if forwarder at all sending the events to Indexer?

0 Karma
1 Solution

sarthakb
Explorer

Interesting Observation - The forwarder is able to send data to indexer in each line does not starts with a date time.

e.g

12/13/2016 12:45:77.907 -0500 Some content 

The above line fails

12/13/2016 Some content 

Above line works

Seems like forwarder is trying to parse date time.

Is there a way to forcefully tell forwarder not to parse datetime?

View solution in original post

0 Karma

sarthakb
Explorer

Interesting Observation - The forwarder is able to send data to indexer in each line does not starts with a date time.

e.g

12/13/2016 12:45:77.907 -0500 Some content 

The above line fails

12/13/2016 Some content 

Above line works

Seems like forwarder is trying to parse date time.

Is there a way to forcefully tell forwarder not to parse datetime?

0 Karma

nekbote
Path Finder

@ sarthakb refer to below thread...you can refer to my answer there to get some tips and also others answers as well

https://answers.splunk.com/answers/5590/could-not-send-data-to-the-output-queue.html#answer-466859

As @chrishartsoc mentioned...your starting point is checking splunkd and metrics log on the forwarder.

0 Karma

ddrillic
Ultra Champion

Good place to start at I can't find my data!

0 Karma

skoelpin
SplunkTrust
SplunkTrust

So the data is being forwarded correctly to your indexer(s) but you cannot find the host when searching?

Can you check the outputs.conf on the forwarder to verify you have the correct hostname there?

C:\SPLUNK_HOME\etc\system\local\outputs.conf

0 Karma

sarthakb
Explorer

Hi, Thanks for the quick reply.

I dont know if the data is being forwarded correctly. I am looking for guidance to confirm that.

regards,
Sarthak

0 Karma

chrishartsock
Path Finder

Along the lines of skoelpin's comment, it sounds like there may be an issue sending from the UF to the indexer. Can you see in the splunkd.log on the UF that the UF is successfully connecting to the indexer?

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...