Getting Data In

One Address is not reachable for a forwarder, all address become unreachable!

robertlynch2020
Influencer

Hi

I had the following issues, i had two address on two different machines configured on one forwarder. I access via /net/.

One machine was shut down hp589srv(so not accessible anymore), but both HOST stopped forwarding data dell439srv as well.
I got no errors, but just spent the day figuring this out.

Is there a way to tell the forwarder that if an address it not reachable ignore it and move on.

[monitor:///net/hp589srv/hp589srv3/apps/TX_ORA_3691008//logs/monitoring/db_rowcounts/*]
disabled = false
host = TX_TST_ndjelveh
index = mlc_live
sourcetype = row_counts
initCrcLength = 4096


[monitor:///net/dell439srv/data1/apps/__COLLAT_BENCH//mlc/timings/*]
disabled = false
host = COLLAT-COMPL-PAC_tkoch
index = mlc_live
sourcetype = lts_timings
whitelist = timings.csv$

Cheers for any help on this 🙂

1 Solution

robertlynch2020
Influencer

Hi - Yes it was

We changed the architecture from each forwarder pulling/pushing from one machine not 2.
So if one goes down it does not affect the other.

Rob

View solution in original post

0 Karma

robertlynch2020
Influencer

Hi - Yes it was

We changed the architecture from each forwarder pulling/pushing from one machine not 2.
So if one goes down it does not affect the other.

Rob

0 Karma

woodcock
Esteemed Legend

This is a SAN, isn't it? Forwarding from SANs is fraught with these kind of problems.

0 Karma

robertlynch2020
Influencer

Hi - Yes it was

We changed the architecture from each forwarder pulling/pushing from one machine not 2.
So if one goes down it does not affect the other.

Rob

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Character substitutions with Regular Expressions

This challenge was first posted on Slack #puzzles channelFor BORE at .conf23, we had a puzzle question which ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

[Puzzles] Solve, Learn, Repeat: Matching cron expressions

This puzzle (first published here) is based on matching timestamps to cron expressions.All the timestamps ...