×

Join the Conversation

Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
Ask a Question
vptltd
Engager
Member since: ‎09-01-2014
a month ago
Community Statistics
Posts 2
Solutions 1
Karma Given 0
Karma Received 2
Member Since ‎09-01-2014
View All

Re: Do Splunk inputs dedicated to universal forwar...

by in Getting Data In
‎09-08-2014 07:59 AM
1 Karma
‎09-08-2014 07:59 AM
1 Karma
Managed to resolve this with the help of tech support and solution is below in case others find it useful. Reverse DNS lookups were indeed the issue. When creating the splunk forwarder input, the default "connection_host" (inputs.conf) is to use reverse dns. In our case no dns/access via firewall was possible to multiple timouts/net traffic generated which was stopping other clients connecting reliably. Edited the input to "connection_host" to "none", restarted splunk and all was well with no further connection timeouts in splunkd.log etc. ... View more

Do Splunk inputs dedicated to universal forwarders...

by in Getting Data In
‎09-04-2014 11:17 AM
1 Karma
‎09-04-2014 11:17 AM
1 Karma
We have around 230 PCs servers spelunking to a single splunk server across a firewall. Many of these clients are not logging data and show connection and timeout errors in splunkd log etc. After some research I have seen suggestions that incorrectly configured reverse DNS may be a cause. Simple question is do the splunk inputs dedicated to universal forwarders need configuration regarding DNS? I thought that the hostname was provided by the splunk forwarder config files rather than DNS. Am I confusing other inputs with which need this? Any advice gratefully received. ... View more
Contact Me
Online Status
Offline
Date Last Visited
a month ago
Karma from
View All