Getting Data In

Why does the forwarder stops sending data to all configured TCP connections when one connection is not available?

dami_rel
Engager

Hello,

I'm new to splunk and hope you can help me with this problem.
I'm using Universal forwarder to send data from Server X to Splunk server A and to a third party Server B.
When third party Server B closes TCP port for any reason, Splunk forwarder on server X stops also sending data to Splunk server A.

How can I prevent forwarder on Server X to close stream to Splunk server A?

My forwarder config on Server X is as follows:

inputs.conf:

[default]
host = TEST
[monitor:///var/log/list.log]
disabled=false
sourcetype=log_iedge
index=vo

[monitor:///var/log/lstat.log]
disabled=false
sourcetype=log_lstat
index=vo

[monitor:///var/log/ISDM.log]
disabled=false
_TCP_ROUTING = Server_B

outputs.conf:

[tcpout]
defaultGroup = default-autolb-group, Server_B

[tcpout:default-autolb-group]
server = A.A.A.A:9998

[tcpout:Server_B]
server = B.B.B.B:9981
sendCookedData = false

felipesewaybric
Contributor

Once I have the same problem, is like the UF cant send to a peer, so he just stops, since he cant send the data, I use load balancing with cluster environment.
Check this docs:
https://docs.splunk.com/Documentation/Splunk/7.1.1/Forwarding/Setuploadbalancingd

0 Karma

nkpiquette
Path Finder

Even with Load Balancing configured though if B refuses/cant receive the data it does not send the data to A even if A has load balancing configured.

0 Karma
Get Updates on the Splunk Community!

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...

Adoption of Infrastructure Monitoring at Splunk

  Splunk's Growth Engineering team showcases one of their first Splunk product adoption-Splunk Infrastructure ...

Modern way of developing distributed application using OTel

Recently, I had the opportunity to work on a complex microservice using Spring boot and Quarkus to develop a ...