Deployment Architecture

Forwarder stopped pushing performance data

siddharthmis
Explorer

Hi,

I had a completely working setup where forwarder was pushing data to UF successfully but it stopped pushing data a week earlier.
There is no error in splunkd.log which can explain the reason.

How do I fix it?

All other indexes are working fine. It's just that performance counters are not pushed. Registry values are fine.

Tags (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi siddharthmis,
only three foolish questions:

  • forwarder time and date are the same of Indexers?
  • did you checked if you're receiving logs in _internal index?
  • surely you checked connection using telnet (telnet indexer_IP 9997).

Bye.
Giuseppe

0 Karma

adonio
Ultra Champion

Hi siddharthmis,
do you mean forwarder pushed data to another forwarder (UF) ? or forwarder sending data to indexer and now it does not send data anymore?

0 Karma

siddharthmis
Explorer

I mean it stopped pushing data to Splunk deployment (indexer)

0 Karma

tlam_splunk
Splunk Employee
Splunk Employee

Hi siddharthmis, are you using Window Perfmon stanza in the UF ?

0 Karma

ppeterson
Path Finder

version/OS info would help, have you tried restarting from the CLI?

0 Karma

siddharthmis
Explorer

Yes but in Vain

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...