Getting Data In

Universal Forwarder

hectorvp
Communicator

Can we detect following from UFs internal logs:

Is TCP connection failed between UF and indexer/HF.

If UF dropped some logs for example from source A, there were 5 logs generated but sent only 4.(data loss)

Failed to monitor certain path or application.

Or are there any other useful info we can fetch from UFs internal logs???

Need to have health check over such 1000UFs.

PS: we don't have access to any other logs, not even indexers internal logs but only UFs logs.

 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @hectorvp,

at first check the connection between your UF and the Indexer, e.g. using telnet (telnet indexer_IP_address 9997).

if it's open, you need to access the internal logs on Search head to understand if the UF is sending logs or not.

If it's closed, you have to solve this problem.

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...