Getting Data In

Why does the forwarder stops sending data to all configured TCP connections when one connection is not available?

dami_rel
Engager

Hello,

I'm new to splunk and hope you can help me with this problem.
I'm using Universal forwarder to send data from Server X to Splunk server A and to a third party Server B.
When third party Server B closes TCP port for any reason, Splunk forwarder on server X stops also sending data to Splunk server A.

How can I prevent forwarder on Server X to close stream to Splunk server A?

My forwarder config on Server X is as follows:

inputs.conf:

[default]
host = TEST
[monitor:///var/log/list.log]
disabled=false
sourcetype=log_iedge
index=vo

[monitor:///var/log/lstat.log]
disabled=false
sourcetype=log_lstat
index=vo

[monitor:///var/log/ISDM.log]
disabled=false
_TCP_ROUTING = Server_B

outputs.conf:

[tcpout]
defaultGroup = default-autolb-group, Server_B

[tcpout:default-autolb-group]
server = A.A.A.A:9998

[tcpout:Server_B]
server = B.B.B.B:9981
sendCookedData = false

felipesewaybric
Contributor

Once I have the same problem, is like the UF cant send to a peer, so he just stops, since he cant send the data, I use load balancing with cluster environment.
Check this docs:
https://docs.splunk.com/Documentation/Splunk/7.1.1/Forwarding/Setuploadbalancingd

0 Karma

nkpiquette
Path Finder

Even with Load Balancing configured though if B refuses/cant receive the data it does not send the data to A even if A has load balancing configured.

0 Karma
Get Updates on the Splunk Community!

Database Performance Sidebar Panel Now on APM Database Query Performance & Service ...

We’ve streamlined the troubleshooting experience for database-related service issues by adding a database ...

IM Landing Page Filter - Now Available

We’ve added the capability for you to filter across the summary details on the main Infrastructure Monitoring ...

Dynamic Links from Alerts to IM Navigators - New in Observability Cloud

Splunk continues to improve the troubleshooting experience in Observability Cloud with this latest enhancement ...