Yesterday I had set up 8 Universal Forwarders on 8 different machines and had them all sending data over to the Receiver just fine. I woke up this morning and got on the receiver and all 8 machines were listed as Missing. I checked the splunkd.log and the outputs.conf files on all Universal Forwarders, and even checked the firewall to verify that it wasn't blocking any outbound or inbound connections over the port I needed. Anybody know why I would've just lost my connections like this?
(The splunkd.log on each of them says connection to ip=XXX.XXX.X.XXX:XXXX has timed out)
I solved the problem, at some point during the night something blacklisted all the IPs that were connecting to the receiver, a simple fix in the end just edited the serverclass.conf file to whitelist the IPs. Thanks for responding though.
I solved the problem, at some point during the night something blacklisted all the IPs that were connecting to the receiver, a simple fix in the end just edited the serverclass.conf file to whitelist the IPs. Thanks for responding though.
So, it was working and stopped sending data? Is Listening enabled on Indexer?with the info provided in the question, it forces me to assume this is related to connectivity issue. More info please
