Why is UF not reporting to DS?

[Vani_26]

Hi, I have 10 hosts, from this only 3 hosts are reporting to DS and 7 are not reporting.
when i searched with _internal i could see only 3 hosts logs are coming in.

How to troubleshoot further on this issue??

[gcusello]

Hi @Vani_26,

in addition to the answer of @yeahnah that's correct (Splunk logs usually describe the problem), I am adding one information: 

connection with Deployment Server and internal logs in _internal are two different things because the connection is established on two different ports and to two different destinations: 8089 with DS and usually 9997 with Indexers.

Anyway, the easiest way to debug the problem is checking the connection with telnet:

telnet <ip_deployment-server> 8089
telnet <ip_indexer> 9997

If telnet fails there's a problem, maybe the internal firewall on the destinations or intermediate firewalls.

Then, did you configured outputs.conf on the Universal Forwarders?

if not, this is the problem, if yes, check the hostname on $SPLUNK_HOME/etc/system/local/server.conf.

Did you used IP address or dns name?

if the second try using IP.

Ciao.

Giuseppe

[yeahnah]

Hi @Vani_26 

It could be any number of possible problems, from misconfiguration, firewall blocking, to agent not running.

A good place to start is to log on to the remote host and check the local Splunk universal forwarder (UF) agent logs under _SLPUNK_HOME_/var/log/spunk directory (assuming Linux).  The UF's splunkd.log file is the best place to start.

Hope that helps