Two systems (System-1, System-2) each with universal forwarder installed.
Server syncs with both System-x but only receives data from System-1
Same dataset on both systems
Same configuration set on both systems
useACK=true for all outputs in outputs.conf
Server reflects registration to all ports:
Fwd src=192.168.12.2:35476 supports ACK
Fwd src=192.168.12.3:4356 supports ACK
System-1 for which content is forwarded without issue the following is noted:
Connected to idx=192.168.12.1:8002 using ACK.
Received ACK for: 32 - 53
Received ACK for: 63 - 85
...continues verbosely
Data transfer is reflected in tcpdump monitoring of System-1 <-> server
System-2, for which content is not forwarding the following is noted:
Connected to idx=192.168.12.1:8005 using ACK.
Received ACK for: 3 - 3
This exchange is repeated every 15 - 30 seconds with no transfer of data
The sync but no data transfer is reflected in tcpdump monitoring of System-2 <-> Server
Could this behavior be attributable to a network component or NIC configuration?
This was not a network issue ...
The files of interest are .dat (OEM name) and considered by Splunk as binary, by default.
The forwarder opened and processed the file but considered the content binary and did not forward.
The answer, Splunk fails monitoring a log file..., lpolo, 23 Oct '12 provided the information needed to solve the problem
This was not a network issue ...
The files of interest are .dat (OEM name) and considered by Splunk as binary, by default.
The forwarder opened and processed the file but considered the content binary and did not forward.
The answer, Splunk fails monitoring a log file..., lpolo, 23 Oct '12 provided the information needed to solve the problem