Getting Data In

How to troubleshoot why my intermediate forwarder is not working, causing 600 universal forwarders to not send data to indexers?

hartfoml
Motivator

I have a ticket in with support but this may be faster.

My intermediate forwarder is not working right. When I restart it, everything works for a few minutes then stops working. I have checked everything that I know to help.

Please help with suggestions. 600 systems are down!!!

1 Solution

hartfoml
Motivator

Splunk Support was relatively quick to respond. Rajpal Bal got on the line and at my request she quickly setup a webex. we looked at SOS and could see that the tcpout on the Intermediate forwarder (IF) was full and the tcpin for the indexers was very low. on Thursday there was a mix up in DNS but this did not affect the IF until Splunk was restarted yesterday. Rajpal suggested and helped me to add the connection_host entry below to the inputs.conf to force Splunk to use IP and not look-up DNS names. we did this on both the IF and the indexers. it did not immediately resolve the issues but over a few hours the IF started its normal behavior and we can fix DNS on Monday.

Thanks Rajpal, for fast, appropriate and extra effort in staying beyond work hours to solve this tricky problem

in the inputs.conf that has the "splunktcp" stanza the "connection_host = ip" for app ports like below

[splunktcp:://]
connection_host = ip

View solution in original post

hartfoml
Motivator

Splunk Support was relatively quick to respond. Rajpal Bal got on the line and at my request she quickly setup a webex. we looked at SOS and could see that the tcpout on the Intermediate forwarder (IF) was full and the tcpin for the indexers was very low. on Thursday there was a mix up in DNS but this did not affect the IF until Splunk was restarted yesterday. Rajpal suggested and helped me to add the connection_host entry below to the inputs.conf to force Splunk to use IP and not look-up DNS names. we did this on both the IF and the indexers. it did not immediately resolve the issues but over a few hours the IF started its normal behavior and we can fix DNS on Monday.

Thanks Rajpal, for fast, appropriate and extra effort in staying beyond work hours to solve this tricky problem

in the inputs.conf that has the "splunktcp" stanza the "connection_host = ip" for app ports like below

[splunktcp:://]
connection_host = ip

MuS
SplunkTrust
SplunkTrust

follow @martin_mueller advice and check the servers ulimit settings; usually if something works for a few minutes and then stops on *nix systems, indicates ulimit being too low.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Usually there would be some indication of what's wrong in the IF's internal logs, especially splunkd.log.

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...