Getting Data In

How to troubleshoot why all 8 of my universal forwarders suddenly lost connection to my receiver?

superiorlabels
Explorer

Yesterday I had set up 8 Universal Forwarders on 8 different machines and had them all sending data over to the Receiver just fine. I woke up this morning and got on the receiver and all 8 machines were listed as Missing. I checked the splunkd.log and the outputs.conf files on all Universal Forwarders, and even checked the firewall to verify that it wasn't blocking any outbound or inbound connections over the port I needed. Anybody know why I would've just lost my connections like this?
(The splunkd.log on each of them says connection to ip=XXX.XXX.X.XXX:XXXX has timed out)

0 Karma
1 Solution

superiorlabels
Explorer

I solved the problem, at some point during the night something blacklisted all the IPs that were connecting to the receiver, a simple fix in the end just edited the serverclass.conf file to whitelist the IPs. Thanks for responding though.

View solution in original post

0 Karma

superiorlabels
Explorer

I solved the problem, at some point during the night something blacklisted all the IPs that were connecting to the receiver, a simple fix in the end just edited the serverclass.conf file to whitelist the IPs. Thanks for responding though.

View solution in original post

0 Karma

aljohnson_splun
Splunk Employee
Splunk Employee

Please accept your own answer if this solved your problem. Glad you found a resolution.

0 Karma

Raghav2384
Motivator

So, it was working and stopped sending data? Is Listening enabled on Indexer?with the info provided in the question, it forces me to assume this is related to connectivity issue. More info please

0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!