Deployment Architecture

Data not coming in from some forwarders

RVDowning
Contributor

I used the deployment monitor to create a new server class and added 11 servers to it. I created an app that just targets a couple of windows performance items. However, I only get data from 4 of the 11 forwarders.

When I look at the server class in the deployment monitor it shows all 11 servers, however on the 7 from which I am getting no data the client name just shows "deploymentClient" whereas on the others there are identifiers such as "C9D11F05-A6AF-4DFC-B003-58174CB478A6"

I don't seem to be able to see anything different between the servers from which I am getting data from the servers from which I am not getting data. Any ideas?

0 Karma
1 Solution

RVDowning
Contributor

Pushed out the latest and greatest, 6.2.1 and all is well.

View solution in original post

0 Karma

RVDowning
Contributor

Pushed out the latest and greatest, 6.2.1 and all is well.

0 Karma

RVDowning
Contributor

Think I finally found out what the issue is. The forwarders that are not sending in performance data are version 4.2.2 and the ones that are sending in that data are 6.0.2. So, I'll push out the newest forwarders and then report back.

0 Karma

RVDowning
Contributor

Forgot to mention that I did restart the forwarder on one of the servers from which no performance data is being retrieved but it made no difference. By the way, these forwarders continue to send in other unrelated data, so the forwarder is working fine. The issue is just with some servers in this new server class.

0 Karma

RVDowning
Contributor

Crickets. 😞

Still not getting data from those other servers and still can find no difference between those that are and those that are not sending in data.

The app-name directory does exist (under the /etc/apps directory) on each machine and the content of the inputs.conf file is identical on each. The content is as follows:

[perfmon://CPU]
counters = *
disabled = 0
instances = _Total
interval = 60
object = Processor
index = perfmon

[perfmon://memory]
counters = *
disabled = 0
instances = *
interval = 60
object = Memory
index = perfmon

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...