Getting Data In

How to troubleshoot why all 8 of my universal forwarders suddenly lost connection to my receiver?

superiorlabels
Explorer

Yesterday I had set up 8 Universal Forwarders on 8 different machines and had them all sending data over to the Receiver just fine. I woke up this morning and got on the receiver and all 8 machines were listed as Missing. I checked the splunkd.log and the outputs.conf files on all Universal Forwarders, and even checked the firewall to verify that it wasn't blocking any outbound or inbound connections over the port I needed. Anybody know why I would've just lost my connections like this?
(The splunkd.log on each of them says connection to ip=XXX.XXX.X.XXX:XXXX has timed out)

0 Karma
1 Solution

superiorlabels
Explorer

I solved the problem, at some point during the night something blacklisted all the IPs that were connecting to the receiver, a simple fix in the end just edited the serverclass.conf file to whitelist the IPs. Thanks for responding though.

View solution in original post

0 Karma

superiorlabels
Explorer

I solved the problem, at some point during the night something blacklisted all the IPs that were connecting to the receiver, a simple fix in the end just edited the serverclass.conf file to whitelist the IPs. Thanks for responding though.

0 Karma

aljohnson_splun
Splunk Employee
Splunk Employee

Please accept your own answer if this solved your problem. Glad you found a resolution.

0 Karma

Raghav2384
Motivator

So, it was working and stopped sending data? Is Listening enabled on Indexer?with the info provided in the question, it forces me to assume this is related to connectivity issue. More info please

0 Karma
Get Updates on the Splunk Community!

This Week's Community Digest - Splunk Community Happenings [9.26.22]

Get the latest news and updates from the Splunk Community here! Upcoming User Group Events! 👏 Check ...

BSides Splunk 2022 - The Call for Papers is now Open!

TLDR; Main Site: https://bsidessplunk.com CFP Site: https://bsidessplunk.com/cfp CFP Opens: December 15th, ...

Sending Metrics to Splunk Enterprise With the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...