server not listing data

[new2splunk21]

I have 5 forwarders forwarding data to my Splunk server

but when I log into this server only two of them are listed this

When I do a TCP dump on the server I can see the forwarder is communicating and sending data but when I log into the web UI the forwarder is not listed

does anybody know what this might be?  the configs on all forwrders is the same.

[PickleRick]

The forwarders are not listed where? Because forwarders may or may not be listed in several places depending on which functionalities you use. They can also not show up anywhere within the gui and still be sending data and be functioning perfectly well.

So what is the actual problem?

[new2splunk21]

and under messages it s ays

[gcusello]

Hi @new2splunk21 ,

I see many different issues that maybe can be reconducted to the same one:

are you sure that the indexers has the resources (storage) to receive all logs? because the message in the last screenshot seems to indicate that there's an issue in the receiver and not in the Forwarder.

Then, did you ever received logs from all the 5 forwarders?

if not, maybe you used the same hostname in some forwarders.

run a search on _internal to see if you have logs from all the forwarders:

index=_internal

Ciao.

Giuseppe

[new2splunk21]

they're not showing up when i go to search and type index="host_audits"

[new2splunk21]

I found the problem, when Splunk was installed it got installed as a heavy forwarder., so it was looking for the next indexer.  

I deleted outputs.conf,  restarted Splunk and it started working.

[gcusello]

Hi @new2splunk21 ,

good for you, see next time!

let us know if we can help you more, or, please, accept one answer for the other people of Community.

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated by all the contributors 😉