Deployment Architecture

Unable to get data from splunk forwarder consistently.

kamal_jagga
Contributor

Hi,

My splunk forwarder is working in-consistently and is not forwarding data regularly. When i restart the forwarder it immediately sends all the data till that time. And then does not forward it till the next restart.

Kindly advise.

Tags (1)
0 Karma
1 Solution

kamal_jagga
Contributor

It seems that some one had removed the entries from transform.conf and props.conf for my index. I updated the entries and the issue got fixed.

View solution in original post

0 Karma

kamal_jagga
Contributor

I have researched and found 2 possible solutions for this.

  1. Too much processing is happening on forwarder. Removing some filtering from transform.conf should solve the issue.
  2. Install another universal forwarder instance on server on which forwarder is installed.
0 Karma

kamal_jagga
Contributor

It seems that some one had removed the entries from transform.conf and props.conf for my index. I updated the entries and the issue got fixed.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Check $SPLUNK_HOME/var/log/splunkd.log on the forwarder - or in Splunk if it managed to forward it - for any messages.

0 Karma

woodcock
Esteemed Legend

I have seen this happen because the forwarder is sorting through too many directories and files If you have inputs.conf like this:

[monitor:///somedir/logs/]
index=myindex
sourcetype=mysourcetype

You need to add this stuff, too, to limit the number of files that Splunk has to examine and the number of directories it has to traverse:

recursive = false
whitelist = *.log
blacklist = *badfile*.log

Also if you are using /.../ in the path of the stanza header, try to be more explicit, even if all you can do is change to /*/

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...