Getting Data In

One Address is not reachable for a forwarder, all address become unreachable!

robertlynch2020
Motivator

Hi

I had the following issues, i had two address on two different machines configured on one forwarder. I access via /net/.

One machine was shut down hp589srv(so not accessible anymore), but both HOST stopped forwarding data dell439srv as well.
I got no errors, but just spent the day figuring this out.

Is there a way to tell the forwarder that if an address it not reachable ignore it and move on.

[monitor:///net/hp589srv/hp589srv3/apps/TX_ORA_3691008//logs/monitoring/db_rowcounts/*]
disabled = false
host = TX_TST_ndjelveh
index = mlc_live
sourcetype = row_counts
initCrcLength = 4096


[monitor:///net/dell439srv/data1/apps/__COLLAT_BENCH//mlc/timings/*]
disabled = false
host = COLLAT-COMPL-PAC_tkoch
index = mlc_live
sourcetype = lts_timings
whitelist = timings.csv$

Cheers for any help on this 🙂

1 Solution

robertlynch2020
Motivator

Hi - Yes it was

We changed the architecture from each forwarder pulling/pushing from one machine not 2.
So if one goes down it does not affect the other.

Rob

View solution in original post

0 Karma

robertlynch2020
Motivator

Hi - Yes it was

We changed the architecture from each forwarder pulling/pushing from one machine not 2.
So if one goes down it does not affect the other.

Rob

0 Karma

woodcock
Esteemed Legend

This is a SAN, isn't it? Forwarding from SANs is fraught with these kind of problems.

0 Karma

robertlynch2020
Motivator

Hi - Yes it was

We changed the architecture from each forwarder pulling/pushing from one machine not 2.
So if one goes down it does not affect the other.

Rob

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...