Getting Data In

Splunk Forwarder with DB Connect : connection not closed with Splunk Indexer

mbennani3492
Engager

I am using Splunk Heavy Forwader with DB Connect to forward data to a Splunk Indexer instance.
Although the HF is not forwarding any data, the connection is still established between the HF and the indexer. I'm talking about a connection that hasn't been closed for more than 3 days with no data sent!
Is anyone having the same problem ? I could use some help, thanks in advance.

0 Karma

jtacy
Builder

That sounds appropriate; forwarders, both universal and heavy, will always try to have a connection open to an indexer. If you have just one indexer, I believe it will keep a single connection open until something interrupts that connection. The connection is probably not idle, either; the HF is probably forwarding data about its internal operation and that data should be in the _internal index on your indexer.

0 Karma

mbennani3492
Engager

Thanks for your answer.
So you are saying that it is normal as long as the HF is sending its internal data to my indexer.
Then how can I make him stop, and send only the data i want it to send ?

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...