Getting Data In

Splunk Forwarder with DB Connect : connection not closed with Splunk Indexer

mbennani3492
Engager

I am using Splunk Heavy Forwader with DB Connect to forward data to a Splunk Indexer instance.
Although the HF is not forwarding any data, the connection is still established between the HF and the indexer. I'm talking about a connection that hasn't been closed for more than 3 days with no data sent!
Is anyone having the same problem ? I could use some help, thanks in advance.

0 Karma

jtacy
Builder

That sounds appropriate; forwarders, both universal and heavy, will always try to have a connection open to an indexer. If you have just one indexer, I believe it will keep a single connection open until something interrupts that connection. The connection is probably not idle, either; the HF is probably forwarding data about its internal operation and that data should be in the _internal index on your indexer.

0 Karma

mbennani3492
Engager

Thanks for your answer.
So you are saying that it is normal as long as the HF is sending its internal data to my indexer.
Then how can I make him stop, and send only the data i want it to send ?