About Cagey

Cagey · ‎03-23-2015

Thank you for your response Rich but this would not solve my problem. All the forwarders report to an indexing server which keeps track, via a database or something, of all the forwarders and when they last reported into the indexer. Now my problem (which actually has two parts) is that I cannot acknowledge the missing forwarders so that they stop showing up in the list of forwarders. To further explain the first part of my problem, suppose I have a forwarder with a DNS name of "forwarder1" and an IP address of "1.2.3.4". My indexer is reporting that "forwarder1" is active but IP address "1.2.3.4" is missing. This is not possible since they are the same device. Obviously this is a problem with the actual code or database which is used to report the forwarders. The second part of the problem is that I DO actually have some forwarders which are no longer in service and they are rightly being reported as missing. However, I know this and would like to acknowledge this to the application and stop having them reported as missing. The problem is, there is no way to do this so every time I go into the application I am once again informed about the missing forwarders. However, if there are any new ones listed it is hard to pick them out from the large list of 65. So, still two problems: Code (or database) needs fixing to correlate the IP with the DNS name. Acknowledgement function required to remove actual "missing" forwarders from the database.

Cagey · ‎03-16-2015

Every time I go into deployment monitor it tells me I have 65 missing forwarders. In all cases these forwarders are listed as an IP address. In some cases the IP address corresponds to a "active" forwarder which is reported by the servers name. In other cases the forwarder is actually no longer in service and needs to be removed from the list of forwarders. I have read other comments regarding this and they mention a forwarder as going "quiet" or deployment monitor have a "remove missing forwarders" button. In my case neither of these is present. As I see it this is actually two problems: 1. making splunk correlate the IP address of the "missing" forwarder to the DNS name for the associated "active" forwarder. 2. remove actual "missing" forwarders from the list of forwarders.

Cagey · ‎07-12-2011

I have several groupwise servers running forwarders to a single index server. For the most part the data is arriving and being indexed but it is not being segmented properly. The entries are being indexed in 100+ line groups and lines are being split across indexed entries. For instance, this entry: 7/12/11 8:43:57.000 AM /mslocal/mshold/po2be3/4/00065cef.001 08:43:57 496 MTP: panthera.macewan.ca: Transmitting file /gw/podom1/mslocal/mshold/po2be3/4/00065cef.001, Size: 22748 08:43:57 496 MTP: panthera.macewan.ca: End-of-file confirmation packet received 08:43:59 304 MTP: po5.podom1: Returning acknowledge (11) 08:43:59 304 MTP: po5.podom1: Returning acknowledge (11) Show all 108 lines The first line is the date/timestamp associated with the entry. The next line (with no timestamp) comes the end of the previous entry and has been split off from it's timestamp. The next 4 lines are properly formatted, However, if I were to "show all 108 lines" then the final line would be broken at a random spot and added at the start of the next entry. It appears that splunk is not recognizing the timestamp as the start of an entry and is just grouping the data as it receives it from the forwarder into a single indexed entry. How do I solve this???

Posts	3
Solutions	0
Karma Given	0
Karma Received	3
Member Since	‎05-06-2011

Online Status	Offline
Date Last Visited	‎06-05-2020 02:02 AM

How do I remove "missing" forwarders from Splunk D...

indexer not properly segmenting groupwise data fro...

Re: How do I remove "missing" forwarders from Splu...

How do I remove "missing" forwarders from Splunk D...

indexer not properly segmenting groupwise data fro...