A forwarder which was working before has stopped for up to a month now. After checking, it is confirmed that the forwarder is correctly configured, the service is running and reporting to the indexer, however there is no data showing on the indexer side or when a search is run on splunk for that forwarder. Can someone please help me in the right direction?
It’s best practices that those three names are same. But those two inside splunk must not to be a server’s hostname. Time by time (e.g. AWS when hostname changes “all” time) is much better to fix it as splunk instance name instead of physical hos/node name.