Installation

Why is my HF unable to forward events?

dionrivera
Explorer

My HF stopped forwarding events. So far:

1. The splunkd service is running 

2. no firewalls enabled

3. Running this command is successful which I think means I'm connecting to the indexers

              $ ./bin/splunk cmd openssl s_client -connect inputs1.<stack>.splunkcloud.com:9997

4. Tried restarting the service with no success. 

5. the splunkd.log file on the HF is reporting a lot of ERROR TcpInputProc errors

 

Help! Thank you

Any suggestions would be appreciated

Labels (2)
0 Karma
1 Solution

dionrivera
Explorer

@isoutamo  As it turns out the hostname on my HF had changed which caused it to lose connection to my Deployment Server. When it lost connection the deploymentclient app was not pushed out to the HF so it did not know how to talk to Splunk cloud. I have re-deployed the correct app and now I'm connecting. Thank you.

View solution in original post

0 Karma

SinghK
Builder
0 Karma

isoutamo
SplunkTrust
SplunkTrust
Could it be that your TLS certs has changed on server side and for that reason it cannot really connect with HF but seems to work with openssl?
What kind of errors you have in splunkd.log on HF side?
0 Karma

dionrivera
Explorer

@isoutamo  As it turns out the hostname on my HF had changed which caused it to lose connection to my Deployment Server. When it lost connection the deploymentclient app was not pushed out to the HF so it did not know how to talk to Splunk cloud. I have re-deployed the correct app and now I'm connecting. Thank you.

0 Karma

venkatasri
SplunkTrust
SplunkTrust
  • Did you check forwarders are active? There must be at least one active forwarder (aka indexer from HF).

 

./splunk list forward-server

 

  •  restarting should clear the queues temporarily they may get blocked again if indexers are busy receiving data. https://wiki.splunk.com/Community:TroubleshootingBlockedQueues
  • Make sure your forwarders are monitoring correctly and connected to HF.  (HF must be under active forwarder list when you execute same command on UF)
0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...