Getting Data In

Sending Data to Splunk Cloud from Heavy Forwarder



I have an app which collects logs and I have configured it to send data to a local enterprise instance of splunk and splunk cloud, I can see the data in the local enterprise instance but not in the cloud instances

I do see the following which shows connection has been established


11-09-2020 10:19:08.710 +0000 INFO Metrics - group=tcpin_connections, ingest_pipe=0,, connectionType=cookedSSL, sourcePort=57829, sourceHost=, sourceIp=, destPort=9997, kb=0.326171875, _tcp_Bps=10.774122169132621, _tcp_KBps=0.010521603680793575, _tcp_avg_thruput=0.011187444180915055, _tcp_Kprocessed=10.939453125, _tcp_eps=0.03225785080578629, _process_time_ms=0, evt_misc_kBps=0, evt_raw_kBps=0, evt_fields_kBps=0, evt_fn_kBps=0, evt_fv_kBps=0, evt_fn_str_kBps=0, evt_fn_meta_dyn_kBps=0, evt_fn_meta_predef_kBps=0, evt_fn_meta_str_kBps=0, evt_fv_num_kBps=0, evt_fv_str_kBps=0, evt_fv_predef_kBps=0, evt_fv_offlen_kBps=0, evt_fv_fp_kBps=0, build=a6754d8441bf, version=8.0.3, os=Linux, arch=x86_64, hostname=splunkforwarder, guid=8ECC1FB9-30F3-4F5E-AB9A-9668E6BCCDDD, fwdType=full, ssl=true, lastIndexer=, ack=false

root@splunkforwarder:/home/linux# /opt/splunk/bin/splunk search 'index=_internal source=*metrics.log* destHost | dedup destHost'
Splunk username: splunk
11-09-2020 10:14:48.227 +0000 INFO StatusMgr -, destIp=, destPort=9997, eventType=connect_fail, publisher=tcpout, sourcePort=8089, statusee=TcpOutputProcessor
11-09-2020 10:02:51.476 +0000 INFO StatusMgr -, destIp=, destPort=9997, eventType=connect_done, publisher=tcpout, sourcePort=8089, statusee=TcpOutputProcessor
11-09-2020 10:02:21.773 +0000 INFO StatusMgr - destHost=, destIp=, destPort=9997, eventType=connect_done, publisher=tcpout, sourcePort=8089, statusee=TcpOutputProcessor

Labels (5)
0 Karma


I am using a heavy forwarder setup (with the app pulling and forwarding data)

0 Karma