Getting Data In

How to troubleshoot why all 8 of my universal forwarders suddenly lost connection to my receiver?

superiorlabels
Explorer

Yesterday I had set up 8 Universal Forwarders on 8 different machines and had them all sending data over to the Receiver just fine. I woke up this morning and got on the receiver and all 8 machines were listed as Missing. I checked the splunkd.log and the outputs.conf files on all Universal Forwarders, and even checked the firewall to verify that it wasn't blocking any outbound or inbound connections over the port I needed. Anybody know why I would've just lost my connections like this?
(The splunkd.log on each of them says connection to ip=XXX.XXX.X.XXX:XXXX has timed out)

0 Karma
1 Solution

superiorlabels
Explorer

I solved the problem, at some point during the night something blacklisted all the IPs that were connecting to the receiver, a simple fix in the end just edited the serverclass.conf file to whitelist the IPs. Thanks for responding though.

View solution in original post

0 Karma

superiorlabels
Explorer

I solved the problem, at some point during the night something blacklisted all the IPs that were connecting to the receiver, a simple fix in the end just edited the serverclass.conf file to whitelist the IPs. Thanks for responding though.

0 Karma

aljohnson_splun
Splunk Employee
Splunk Employee

Please accept your own answer if this solved your problem. Glad you found a resolution.

0 Karma

Raghav2384
Motivator

So, it was working and stopped sending data? Is Listening enabled on Indexer?with the info provided in the question, it forces me to assume this is related to connectivity issue. More info please

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...