I am using Splunk Heavy Forwader with DB Connect to forward data to a Splunk Indexer instance.
Although the HF is not forwarding any data, the connection is still established between the HF and the indexer. I'm talking about a connection that hasn't been closed for more than 3 days with no data sent!
Is anyone having the same problem ? I could use some help, thanks in advance.
That sounds appropriate; forwarders, both universal and heavy, will always try to have a connection open to an indexer. If you have just one indexer, I believe it will keep a single connection open until something interrupts that connection. The connection is probably not idle, either; the HF is probably forwarding data about its internal operation and that data should be in the _internal
index on your indexer.
Thanks for your answer.
So you are saying that it is normal as long as the HF is sending its internal data to my indexer.
Then how can I make him stop, and send only the data i want it to send ?