Getting Data In

One Address is not reachable for a forwarder, all address become unreachable!

robertlynch2020
Motivator

Hi

I had the following issues, i had two address on two different machines configured on one forwarder. I access via /net/.

One machine was shut down hp589srv(so not accessible anymore), but both HOST stopped forwarding data dell439srv as well.
I got no errors, but just spent the day figuring this out.

Is there a way to tell the forwarder that if an address it not reachable ignore it and move on.

[monitor:///net/hp589srv/hp589srv3/apps/TX_ORA_3691008//logs/monitoring/db_rowcounts/*]
disabled = false
host = TX_TST_ndjelveh
index = mlc_live
sourcetype = row_counts
initCrcLength = 4096


[monitor:///net/dell439srv/data1/apps/__COLLAT_BENCH//mlc/timings/*]
disabled = false
host = COLLAT-COMPL-PAC_tkoch
index = mlc_live
sourcetype = lts_timings
whitelist = timings.csv$

Cheers for any help on this 🙂

1 Solution

robertlynch2020
Motivator

Hi - Yes it was

We changed the architecture from each forwarder pulling/pushing from one machine not 2.
So if one goes down it does not affect the other.

Rob

View solution in original post

0 Karma

robertlynch2020
Motivator

Hi - Yes it was

We changed the architecture from each forwarder pulling/pushing from one machine not 2.
So if one goes down it does not affect the other.

Rob

0 Karma

woodcock
Esteemed Legend

This is a SAN, isn't it? Forwarding from SANs is fraught with these kind of problems.

0 Karma

robertlynch2020
Motivator

Hi - Yes it was

We changed the architecture from each forwarder pulling/pushing from one machine not 2.
So if one goes down it does not affect the other.

Rob

0 Karma
Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...