Splunk Enterprise

UF Logs Sent to Indexer but cannot be seen in Forwarder Management

zekiramhi
Path Finder

Hello,

During the health checkup period of our uf connectors, mainly Linux OS's have been seen as sending logs to indexers parsed correctly but cannot be seen when the same host is searched in the Deployment Server's "Forwarder Management" page.

A couple of notes to follow up with here:

1. Connections to the deployment server are allowed and seen as traffic is going from the uf to the deployment server without interference

2. No duplicate GUIDs are found relating to the specified hosts

What are some other recommendations to troubleshoot this issue?

Thanks,

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Check the forwarders logs to make sure they're able to phone home successfully.  Look for "DC:" events.

Make sure the forwarders have a deploymentclient.conf file that references the correct DS.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Check the forwarders logs to make sure they're able to phone home successfully.  Look for "DC:" events.

Make sure the forwarders have a deploymentclient.conf file that references the correct DS.

---
If this reply helps you, Karma would be appreciated.
0 Karma

zekiramhi
Path Finder

After checking the splunkd logs for all the machines with the same situation, they all had the same following message in the logs concerning DC:

DC:DeploymentClient - channel=tenantService/handshake Will retry sending handshake message to DS; err=not_connected

deploymentclient.conf also seems to be pointing to the correct DNS name for the deployment server. I assume there is a DNS problem here that happenned After the initial setup was made, will checkup with the server owners. But until then, thank you for the input.

Best Regards,

0 Karma

zekiramhi
Path Finder

Thank you for the recommendations, I have requested the specific log files to proceed with the investigation.

Will reply back as soon as the research has been completed.

0 Karma
Get Updates on the Splunk Community!

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...