I am using Splunk Heavy Forwader with DB Connect to forward data to a Splunk Indexer instance.
Although the HF is not forwarding any data, the connection is still established between the HF and the indexer. I'm talking about a connection that hasn't been closed for more than 3 days with no data sent!
Is anyone having the same problem ? I could use some help, thanks in advance.
That sounds appropriate; forwarders, both universal and heavy, will always try to have a connection open to an indexer. If you have just one indexer, I believe it will keep a single connection open until something interrupts that connection. The connection is probably not idle, either; the HF is probably forwarding data about its internal operation and that data should be in the _internal index on your indexer.