Getting Data In

Need help for forwarding data to indexer: configuration monitor

qubick
Path Finder

I am trying to forward only CPU/Memory load log to the indexer. Here is what I've done so far:

  1. Installed indexer(just an instance of splunk) to the server (host)
  2. Added 9997 under Settings > Receiving and forwarding > receiving configuration
  3. Installed splunkforwarder to my local machine
  4. Added hostname(server's hostname):9997 under Settings > Receiving and forwarding > forwarding configuration
  5. Installed apps for *nix to both of machines

Here's my question:

  1. How can I check the forwarder actually sends data to indexer?
  2. How can I check the indexer actually receives data from forwarder? (I checked /opt/~ … ~/splunk list forward-server at the local machine's cmd, but getting nothing)
  3. How can I limit kinds of file (data) forwarded to indexer (in order to send only CPU/Memory load)?

I will appreciate if someone gives me step by step instruction to configure settings:

+)
I am seeing the error message says like the following from forwarder's web UI

! Tcp outout pipeline blocked. Attempt '18600'to insert data failed
! skipped indexing of internal audit even will keep dropping events until indexer congestion is remedied.

Are theses related to the connection between indexer and forwarder?

0 Karma
1 Solution

linu1988
Champion

Install the deployment monitor app from here:

http://apps.splunk.com/app/1294/

more over you can know from host=* command will give you the number of hosts which forwarded the data. Restart the indexer if the issue persists, happens due to busy splunkd or network blockages.

Thanks

View solution in original post

linu1988
Champion

Install the deployment monitor app from here:

http://apps.splunk.com/app/1294/

more over you can know from host=* command will give you the number of hosts which forwarded the data. Restart the indexer if the issue persists, happens due to busy splunkd or network blockages.

Thanks

Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...