Getting Data In

How to troubleshoot why all 8 of my universal forwarders suddenly lost connection to my receiver?

superiorlabels
Explorer

Yesterday I had set up 8 Universal Forwarders on 8 different machines and had them all sending data over to the Receiver just fine. I woke up this morning and got on the receiver and all 8 machines were listed as Missing. I checked the splunkd.log and the outputs.conf files on all Universal Forwarders, and even checked the firewall to verify that it wasn't blocking any outbound or inbound connections over the port I needed. Anybody know why I would've just lost my connections like this?
(The splunkd.log on each of them says connection to ip=XXX.XXX.X.XXX:XXXX has timed out)

0 Karma
1 Solution

superiorlabels
Explorer

I solved the problem, at some point during the night something blacklisted all the IPs that were connecting to the receiver, a simple fix in the end just edited the serverclass.conf file to whitelist the IPs. Thanks for responding though.

View solution in original post

0 Karma

superiorlabels
Explorer

I solved the problem, at some point during the night something blacklisted all the IPs that were connecting to the receiver, a simple fix in the end just edited the serverclass.conf file to whitelist the IPs. Thanks for responding though.

0 Karma

aljohnson_splun
Splunk Employee
Splunk Employee

Please accept your own answer if this solved your problem. Glad you found a resolution.

0 Karma

Raghav2384
Motivator

So, it was working and stopped sending data? Is Listening enabled on Indexer?with the info provided in the question, it forces me to assume this is related to connectivity issue. More info please

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...

Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...