On the Splunk Light server (indexer + UI , configured to be Distributer) i did the following:
I installed the Splunk Add-on for Unix and Linux (Splunk_TA_nix) according to instructions.
I set up the class so all my servers are included for this app.
Configured which scripts it should run (external data input scripts)
I restarted several times.
Each server I want to monitor has an Universal Forwarder installed.
Now, only **2** out of the total 5 forwarders return "Splunk_TA_nix app" metrics.
They are all identical in OS, Firewalling, Forwarder installation procedure.
Is there a way to make this work, without changing each forwarder individually? Because if it were like 500 instead of 5 forwarders, i would have a problem.
Thanks in advance.
↧