Splunk Enterprise

We found missing logs and timestamp issues for AIX agent

jerjer951109
Loves-to-Learn

Our heavy forwarder is 8.0.0 and splunk server is 8.0.2 and AIX agent is 6.3.1.
AIX agent will send logs to heavy forwarder and heavy forwarder will send logs to splunk server.
We found that the splunk server cannot completely and correctly receive all the logs of AIX .

However, we cannot upgrade the AIX agent for some reasons. 
is it possibly solve this problem?

Labels (1)
0 Karma

The_Simko
Path Finder

You aren't without hope, but you likely are going to need an intermediate forwarder to handle this traffic.  

Fire up a 7x Heavy Forwarder to act as an intermediate forwarder for this traffic.

6.3.x is in limited support, and according to the forwarder documentation, is able to send Event data (and metrics data) to 7x Splunk Indexers. 

https://docs.splunk.com/Documentation/Forwarder/latest/Forwarder/Compatibilitybetweenforwardersandin...

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...

Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...