Getting Data In

Need help for forwarding data to indexer: configuration monitor

qubick
Path Finder

I am trying to forward only CPU/Memory load log to the indexer. Here is what I've done so far:

  1. Installed indexer(just an instance of splunk) to the server (host)
  2. Added 9997 under Settings > Receiving and forwarding > receiving configuration
  3. Installed splunkforwarder to my local machine
  4. Added hostname(server's hostname):9997 under Settings > Receiving and forwarding > forwarding configuration
  5. Installed apps for *nix to both of machines

Here's my question:

  1. How can I check the forwarder actually sends data to indexer?
  2. How can I check the indexer actually receives data from forwarder? (I checked /opt/~ … ~/splunk list forward-server at the local machine's cmd, but getting nothing)
  3. How can I limit kinds of file (data) forwarded to indexer (in order to send only CPU/Memory load)?

I will appreciate if someone gives me step by step instruction to configure settings:

+)
I am seeing the error message says like the following from forwarder's web UI

! Tcp outout pipeline blocked. Attempt '18600'to insert data failed
! skipped indexing of internal audit even will keep dropping events until indexer congestion is remedied.

Are theses related to the connection between indexer and forwarder?

0 Karma
1 Solution

linu1988
Champion

Install the deployment monitor app from here:

http://apps.splunk.com/app/1294/

more over you can know from host=* command will give you the number of hosts which forwarded the data. Restart the indexer if the issue persists, happens due to busy splunkd or network blockages.

Thanks

View solution in original post

linu1988
Champion

Install the deployment monitor app from here:

http://apps.splunk.com/app/1294/

more over you can know from host=* command will give you the number of hosts which forwarded the data. Restart the indexer if the issue persists, happens due to busy splunkd or network blockages.

Thanks

Get Updates on the Splunk Community!

ATTENTION!! We’re MOVING (not really)

Hey, all! In an effort to keep this Slack workspace secure and also to make our new members' experience easy, ...

Splunk Admins: Build a Smarter Stack with These Must-See .conf25 Sessions

  Whether you're running a complex Splunk deployment or just getting your bearings as a new admin, .conf25 ...

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...