Installation

Why is my HF unable to forward events?

dionrivera
Communicator

My HF stopped forwarding events. So far:

1. The splunkd service is running 

2. no firewalls enabled

3. Running this command is successful which I think means I'm connecting to the indexers

              $ ./bin/splunk cmd openssl s_client -connect inputs1.<stack>.splunkcloud.com:9997

4. Tried restarting the service with no success. 

5. the splunkd.log file on the HF is reporting a lot of ERROR TcpInputProc errors

 

Help! Thank you

Any suggestions would be appreciated

Labels (2)
0 Karma
1 Solution

dionrivera
Communicator

@isoutamo  As it turns out the hostname on my HF had changed which caused it to lose connection to my Deployment Server. When it lost connection the deploymentclient app was not pushed out to the HF so it did not know how to talk to Splunk cloud. I have re-deployed the correct app and now I'm connecting. Thank you.

View solution in original post

0 Karma

isoutamo
SplunkTrust
SplunkTrust
Could it be that your TLS certs has changed on server side and for that reason it cannot really connect with HF but seems to work with openssl?
What kind of errors you have in splunkd.log on HF side?
0 Karma

dionrivera
Communicator

@isoutamo  As it turns out the hostname on my HF had changed which caused it to lose connection to my Deployment Server. When it lost connection the deploymentclient app was not pushed out to the HF so it did not know how to talk to Splunk cloud. I have re-deployed the correct app and now I'm connecting. Thank you.

0 Karma

venkatasri
SplunkTrust
SplunkTrust
  • Did you check forwarders are active? There must be at least one active forwarder (aka indexer from HF).

 

./splunk list forward-server

 

  •  restarting should clear the queues temporarily they may get blocked again if indexers are busy receiving data. https://wiki.splunk.com/Community:TroubleshootingBlockedQueues
  • Make sure your forwarders are monitoring correctly and connected to HF.  (HF must be under active forwarder list when you execute same command on UF)
0 Karma
Get Updates on the Splunk Community!

Strengthen Your Future: A Look Back at Splunk 10 Innovations and .conf25 Highlights!

The Big One: Splunk 10 is Here!  The moment many of you have been waiting for has arrived! We are thrilled to ...

Now Offering the AI Assistant Usage Dashboard in Cloud Monitoring Console

Today, we’re excited to announce the release of a brand new AI assistant usage dashboard in Cloud Monitoring ...

Stay Connected: Your Guide to October Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...