Getting Data In

No indexing of log after receiving in heavy forwarder

sohrab_keramat
New Member

Hello to all dear friends and fellow platformers

I have 36 indexers and 7 heavy forwarders in my cluster. Every once in a while, I notice that one of the equipments that I receive logs from is not entered into Splunk, and the log is actually reported from the source, but with further investigations, I realize that the log From the source means that the desired equipment is sent and received in one of the 7 HF, but the problem is that either the HF does not send to the indexers or the indexers do not index the log, so according to the Splunk system, the log is disconnected from the source of the equipment?

a. Do you have a solution so that in the scenario of indexer clustering and a large number of HFs, I can find out whether the log is correctly outputted from the HF to the indexer or not?

B. What is the cause and solution of this problem?

THank you.

Labels (2)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @sohrab_keramat,

I know that in the logs there isn't the information on the system that a log is passed through, so how can you say that a log is sent to an HF and it isn't sent to the Indexers?

maybe you're sending log from the missed device only to one HF?

have you other logs (e.g. Splunk internal logs) from that HF?

did you tried to sen logs from that device to other HFs?

did you checked the configurations on the HF to input logs from that device?

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...