Getting Data In

Monitoring linux forward to ensure communication

timmy13
Communicator

We encountered a forwarder that was not sending data to the indexer nor phoning home. This forwarder's data is a dependancy of many other processes. We found that the splunkd processes were orphaned, killed them, and indexing began working. Is there a way to monitor that splunk is actually sending data?

0 Karma

aljohnson_splun
Splunk Employee
Splunk Employee

Are you really actually looking to see if data is being sent ? Or are you maybe more interested in whether or not its being received ?

I would use the

Distributed Management Console

alt text


Then check out Indexing Performance

alt text


Or check out this answer, where they suggest going to

http://54.183.100.158:8000/en-US/app/search/indexing_volume

in order to split by host.


Or maybe you'd rather go old school, ssh into your indexer, and

sudo tcpdump port 9997

where 9997 is the port that you are forwarding to.


Or maybe you'd just like to use the _internal index. Or you could check splunkd.log.

See this answer for quite a few more options.


A link from the Wiki on troubleshooting forwarding.

0 Karma
Get Updates on the Splunk Community!

Join Us for Splunk University and Get Your Bootcamp Game On!

If you know, you know! Splunk University is the vibe this summer so register today for bootcamps galore ...

.conf24 | Learning Tracks for Security, Observability, Platform, and Developers!

.conf24 is taking place at The Venetian in Las Vegas from June 11 - 14. Continue reading to learn about the ...

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...