Getting Data In

How to troubleshoot why my intermediate forwarder is not working, causing 600 universal forwarders to not send data to indexers?

hartfoml
Motivator

I have a ticket in with support but this may be faster.

My intermediate forwarder is not working right. When I restart it, everything works for a few minutes then stops working. I have checked everything that I know to help.

Please help with suggestions. 600 systems are down!!!

1 Solution

hartfoml
Motivator

Splunk Support was relatively quick to respond. Rajpal Bal got on the line and at my request she quickly setup a webex. we looked at SOS and could see that the tcpout on the Intermediate forwarder (IF) was full and the tcpin for the indexers was very low. on Thursday there was a mix up in DNS but this did not affect the IF until Splunk was restarted yesterday. Rajpal suggested and helped me to add the connection_host entry below to the inputs.conf to force Splunk to use IP and not look-up DNS names. we did this on both the IF and the indexers. it did not immediately resolve the issues but over a few hours the IF started its normal behavior and we can fix DNS on Monday.

Thanks Rajpal, for fast, appropriate and extra effort in staying beyond work hours to solve this tricky problem

in the inputs.conf that has the "splunktcp" stanza the "connection_host = ip" for app ports like below

[splunktcp:://]
connection_host = ip

View solution in original post

hartfoml
Motivator

Splunk Support was relatively quick to respond. Rajpal Bal got on the line and at my request she quickly setup a webex. we looked at SOS and could see that the tcpout on the Intermediate forwarder (IF) was full and the tcpin for the indexers was very low. on Thursday there was a mix up in DNS but this did not affect the IF until Splunk was restarted yesterday. Rajpal suggested and helped me to add the connection_host entry below to the inputs.conf to force Splunk to use IP and not look-up DNS names. we did this on both the IF and the indexers. it did not immediately resolve the issues but over a few hours the IF started its normal behavior and we can fix DNS on Monday.

Thanks Rajpal, for fast, appropriate and extra effort in staying beyond work hours to solve this tricky problem

in the inputs.conf that has the "splunktcp" stanza the "connection_host = ip" for app ports like below

[splunktcp:://]
connection_host = ip

MuS
SplunkTrust
SplunkTrust

follow @martin_mueller advice and check the servers ulimit settings; usually if something works for a few minutes and then stops on *nix systems, indicates ulimit being too low.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Usually there would be some indication of what's wrong in the IF's internal logs, especially splunkd.log.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...