Monitoring Splunk

what is connection between forwarder and DS

Reethika
Path Finder

We noticed that a host "1234"  is not longer connecting with the DS. 

What does this mean? 

What would be the impact?

How do we troubleshoot this?

 Thanks.

 

 

Labels (2)
Tags (1)
0 Karma

anilchaithu
Builder

@Reethika 

If its not communicating, you can no longer deploy apps to the client. 

1) Does the client sending data to splunk indexer?

index=_internal host="client"

2) If yes, try to restart splunk service on the client

3) Is there any firewall between client & Deployment Server?

you can check this from DC doing telnet forwarderip:9997

4) if it checks out, please look for errors in the splunkd logs on the client .

Tags (1)
0 Karma
Get Updates on the Splunk Community!

Accelerating Observability as Code with the Splunk AI Assistant

We’ve seen in previous posts what Observability as Code (OaC) is and how it’s now essential for managing ...

Integrating Splunk Search API and Quarto to Create Reproducible Investigation ...

 Splunk is More Than Just the Web Console For Digital Forensics and Incident Response (DFIR) practitioners, ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...