Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About nagesh
nagesh
Loves-to-Learn Everything
Member since:
08-11-2020
04-19-2024
Community Statistics
| Posts | 6 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 0 |
| Member Since | 08-11-2020 |
Activity Feed
- Posted Re: How to send the logs from Universal forwaders to Heavy forwaders ? on Getting Data In. 12-10-2023 07:28 PM
- Posted Re: How to send the logs from Universal forwaders to Heavy forwaders ? on Getting Data In. 12-06-2023 05:23 AM
- Posted Re: How to send the logs from Universal forwaders to Heavy forwaders ? on Getting Data In. 12-06-2023 04:22 AM
- Posted Re: How to send the logs from Universal forwaders to Heavy forwaders ? on Getting Data In. 12-06-2023 02:35 AM
- Posted Re: How to send the logs from Universal forwaders to Heavy forwaders ? on Getting Data In. 12-06-2023 02:18 AM
- Posted How to send the logs from Universal forwaders to Heavy forwaders ? on Getting Data In. 12-06-2023 01:36 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 |
12-10-2023
07:28 PM
Any suggestions?
... View more
12-06-2023
05:23 AM
Yes, I have already created output.conf file and added the required info.
It is placed under the etc/system/local/ folder.
[tcpout]
defaultGroup = default-autolb-group
indexAndForward = 0
negotiateProtocolLevel = 0
sslCommonNameToCheck = *.<<stack>>.splunkcloud.com
sslVerifyServerCert = true
useClientSSLCompression = true
[tcpout-server://inputs1.<<stack>>.splunkcloud.com:9997]
[tcpout-server://inputs2.<<stack>>.splunkcloud.com:9997]
[tcpout-server://inputs14.align.splunkcloud.com:9997]
[tcpout:default-autolb-group]
disabled = false
server = 54.85.90.105:9997, inputs2.<<stack>>.splunkcloud.com:9997, inputs3.<<stack>>.splunkcloud.com:9997, .....
inputs15.<<stack>>.splunkcloud.com:9997
[tcpout-server://inputs15.<<stack>>.splunkcloud.com:9997]
sslCommonNameToCheck = *.<<stack>>.splunkcloud.com
sslVerifyServerCert = false
sslVerifyServerName = false
useClientSSLCompression = true
autoLBFrequency = 120
[tcpout:scs]
disabled=1
server = stack.forwarders.scs.splunk.com:9997
compressed = true
... View more
12-06-2023
04:22 AM
Yes, I have created output.conf file and added the required info. It is placed under etc/system/local/ folder. tcpout] defaultGroup = default-autolb-group indexAndForward = 0 negotiateProtocolLevel = 0 sslCommonNameToCheck = *.<<stack>>.splunkcloud.com sslVerifyServerCert = true useClientSSLCompression = true [tcpout-server://inputs1.<<stack>>.splunkcloud.com:9997] [tcpout-server://inputs2.<<stack>>.splunkcloud.com:9997] [tcpout-server://inputs14.align.splunkcloud.com:9997] [tcpout:default-autolb-group] disabled = false server = 54.85.90.105:9997, inputs2.<<stack>>.splunkcloud.com:9997, inputs3.<<stack>>.splunkcloud.com:9997, ..... inputs15.<<stack>>.splunkcloud.com:9997 [tcpout-server://inputs15.<<stack>>.splunkcloud.com:9997] sslCommonNameToCheck = *.<<stack>>.splunkcloud.com sslVerifyServerCert = false sslVerifyServerName = false useClientSSLCompression = true autoLBFrequency = 120 [tcpout:scs] disabled=1 server = stack.forwarders.scs.splunk.com:9997 compressed = true
... View more
12-06-2023
02:35 AM
Yes, I am trying to send the data to splunk cloud. The log file i am trying to receive from UF. [root@HFNode bin]# telnet inputs2.align.<<stack>>.com 9997 Trying 54.159.30.2... Connected to inputs2.<<stack>>.splunkcloud.com. Escape character is '^]'. ^C^C^CConnection closed by foreign host. Connected successfully.
... View more
12-06-2023
02:18 AM
yes , we have the connectivity. splunk.exe cmd btool outputs list UF node: [tcpout-server://UFnode:9997] [tcpout:default-autolb-group] server =UFnode:9997 HF: Not getting the logs in splunk while using the index="_internal" host=""
... View more
12-06-2023
01:36 AM
I am trying to send the data from client machine (UF) installed and Heavy forwarder installed on other machine. But i am getting the below error. 12-06-2023 10:01:22.626 +0100 INFO ClientSessionsManager [3779231 TcpChannelThread] - Adding client: ip=10.112.73.20 uts=windows-x64 id=86E862DA-2CDC-4B21-9E37-45DFF4C5EFBE name=86E862DA-2CDC-4B21-9E37-45DFF4C5EFBE 12-06-2023 10:01:22.626 +0100 INFO ClientSessionsManager [3779231 TcpChannelThread] - ip=10.112.73.20 name=86E862DA-2CDC-4B21-9E37-45DFF4C5EFBE New record for sc=100_IngestAction_AutoGenerated app=splunk_ingest_actions: action=Phonehome result=Ok checksum=0 12-06-2023 10:01:24.551 +0100 INFO AutoLoadBalancedConnectionStrategy [3778953 TcpOutEloop] - Removing quarantine from idx=3.234.1.140:9997 connid=0 12-06-2023 10:01:24.551 +0100 INFO AutoLoadBalancedConnectionStrategy [3778953 TcpOutEloop] - Removing quarantine from idx=54.85.90.105:9997 connid=0 12-06-2023 10:01:24.784 +0100 ERROR TcpOutputFd [3778953 TcpOutEloop] - Read error. Connection reset by peer 12-06-2023 10:01:25.028 +0100 ERROR TcpOutputFd [3778953 TcpOutEloop] - Read error. Connection reset by peer 12-06-2023 10:01:28.082 +0100 WARN TcpOutputProc [3779070 indexerPipe_1] - The TCP output processor has paused the data flow. Forwarding to host_dest=inputs10.align.splunkcloud.com inside output group default-autolb-group from host_src=prdpl2splunk02.aligntech.com has been blocked for blocked_seconds=60. This can stall the data flow towards indexing and other network outputs. Review the receiving system's health in the Splunk Monitoring Console. It is probably not accepting data.
... View more
Labels
- Labels:
-
heavy forwarder
-
universal forwarder
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
04-19-2024
02:28 AM
|
