Splunk Enterprise

UF Logs Sent to Indexer but cannot be seen in Forwarder Management

zekiramhi
Path Finder

Hello,

During the health checkup period of our uf connectors, mainly Linux OS's have been seen as sending logs to indexers parsed correctly but cannot be seen when the same host is searched in the Deployment Server's "Forwarder Management" page.

A couple of notes to follow up with here:

1. Connections to the deployment server are allowed and seen as traffic is going from the uf to the deployment server without interference

2. No duplicate GUIDs are found relating to the specified hosts

What are some other recommendations to troubleshoot this issue?

Thanks,

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Check the forwarders logs to make sure they're able to phone home successfully.  Look for "DC:" events.

Make sure the forwarders have a deploymentclient.conf file that references the correct DS.

---
If this reply helps you, an upvote would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Check the forwarders logs to make sure they're able to phone home successfully.  Look for "DC:" events.

Make sure the forwarders have a deploymentclient.conf file that references the correct DS.

---
If this reply helps you, an upvote would be appreciated.

View solution in original post

0 Karma

zekiramhi
Path Finder

After checking the splunkd logs for all the machines with the same situation, they all had the same following message in the logs concerning DC:

DC:DeploymentClient - channel=tenantService/handshake Will retry sending handshake message to DS; err=not_connected

deploymentclient.conf also seems to be pointing to the correct DNS name for the deployment server. I assume there is a DNS problem here that happenned After the initial setup was made, will checkup with the server owners. But until then, thank you for the input.

Best Regards,

0 Karma

zekiramhi
Path Finder

Thank you for the recommendations, I have requested the specific log files to proceed with the investigation.

Will reply back as soon as the research has been completed.

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.