Splunk Enterprise

We found missing logs and timestamp issues for AIX agent


Our heavy forwarder is 8.0.0 and splunk server is 8.0.2 and AIX agent is 6.3.1.
AIX agent will send logs to heavy forwarder and heavy forwarder will send logs to splunk server.
We found that the splunk server cannot completely and correctly receive all the logs of AIX .

However, we cannot upgrade the AIX agent for some reasons. 
is it possibly solve this problem?

Labels (1)
0 Karma


You aren't without hope, but you likely are going to need an intermediate forwarder to handle this traffic.  

Fire up a 7x Heavy Forwarder to act as an intermediate forwarder for this traffic.

6.3.x is in limited support, and according to the forwarder documentation, is able to send Event data (and metrics data) to 7x Splunk Indexers. 


0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!