Splunk Enterprise

We found missing logs and timestamp issues for AIX agent

jerjer951109
Loves-to-Learn

Our heavy forwarder is 8.0.0 and splunk server is 8.0.2 and AIX agent is 6.3.1.
AIX agent will send logs to heavy forwarder and heavy forwarder will send logs to splunk server.
We found that the splunk server cannot completely and correctly receive all the logs of AIX .

However, we cannot upgrade the AIX agent for some reasons. 
is it possibly solve this problem?

Labels (1)
0 Karma

The_Simko
SplunkTrust
SplunkTrust

You aren't without hope, but you likely are going to need an intermediate forwarder to handle this traffic.  

Fire up a 7x Heavy Forwarder to act as an intermediate forwarder for this traffic.

6.3.x is in limited support, and according to the forwarder documentation, is able to send Event data (and metrics data) to 7x Splunk Indexers. 

https://docs.splunk.com/Documentation/Forwarder/latest/Forwarder/Compatibilitybetweenforwardersandin...

0 Karma
Get Updates on the Splunk Community!

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...