Why is there data Ingestion Issue through Heavy Forwarder?

[sahilvats]

Hi ,

I am looking for troubleshooting steps for Data Ingestion Issue through Heavy Forwarder

[gcusello]

Hi @sahilvats,

could you share some additionsl information?

e.g.: are you ingesting syslog data from the HF?

data are ingested by UFs passing through the HF?

are you speaking ok local data, or DB-Connect data or Cloud data?

Ciao.

Giuseppe

[sahilvats]

Hi @gcusello 

Thank you  so much for the response.

We are ingesting data from remote machines, basically collecting logs from remote machines and forwarding them for further processing.

here i am looking to identify the basic troubleshooting guide for data ingestion issue through HF

[gcusello]

Hi @sahilvats,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉

[gcusello]

Hi @sahilvats,

if you're using an intermediate HF between UFs and Indexers, you don't need any input, but you have to add all the props.conf and transforms.conf to parse your data, because parsing in Splunk is executed in the first full Splunk Instance that te data passing through.

In other words: if you have to collect data from windows UFs, you have to install the Splunk_TA_Windows on UFs, on Search Heads and on HF.

Ciao.

Giuseppe