Quantcast
Channel: Questions in topic: "universal-forwarder"
Viewing all articles
Browse latest Browse all 1551

No data from indexes in cloud search head

$
0
0
Hi everyone, I could really use some input from you all. I am using Splunk cloud in my environment, with a deployment server on-prem for universal forwarders. Two days ago, I stopped receiving data in six indexes. The data retrieved from the indexes originates from a Syslog server. Steps I have taken so far: Verify logs are currently being created in Syslog from the sources Verify Syslog server can still reach deployment server via ping Verify Splunkd is running on the Syslog server Verify deployment server has received a recent phone home from the Syslog server Verify data from other universal forwarders is searchable on the Search head

Viewing all articles
Browse latest Browse all 1551

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>