![]() = C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exe\n = \n = punct::\n = WpC6rhVY9yDblPB.C\n = source::WinEventLog\n = host::HOSTNAME-2\n = sourcetype::WinEventLog\n = _done\n = _linebreaker\n = source::WinEventLog|host::HOSTNAME-2|WinEventLog|\n = C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exe\n = \n = punct::\n = FSDNhUnXitGgjKJ.C\n = source::WinEventLog\n = host::HOSTNAME-1\n = sourcetype::WinEventLog\n = _done\n = _linebreaker\n = source::WinEventLog|host::HOSTNAME-1|WinEventLog|\nĠ7-01-2022 12:36:18.966 +0200 WARN TcpOutputProc - Pipeline data does not have indexKey. ![]() Until it suddenly logs this one or a few times:Ġ7-01-2022 12:36:15.628 +0200 WARN TcpOutputProc - Pipeline data does not have indexKey. It turns out after looking in splunkd.log, that it seems like one pipeline has simply shut down (I didn't know this was even possible).Īt first, splunkd.log is filled with the usual over and over:Ġ7-01-2022 12:35:55.724 +0200 INFO TailReader - Batch input finished reading file='D:\Splunk\var\spool\splunk\tracker.log'Ġ7-01-2022 12:35:59.129 +0200 INFO AutoLoadBalancedConnectionStrategy - Connected to idx=X.X.X.X:9997:0, pset=1, reuse=0. I can also mention that all parts of this environment is running on Windows.Ī few times I've suddenly had 100% queue on all the four data queues(parsing/aggregation/typing/indexing) on one of the Heavy Forwarders and only on one of its pipelines, but not the other. ![]() The Heavy Forwarders are also configured with parallelIngestionPipelines=2. The heavy forwarders are there to do some filtering, and also routing of specific data to other Splunk environments. UFs sending logs with -> Load Balancer -> A set of Heavy Forwarders receiving data via -> Index cluster receiving data with. We have rolled this out to a small porsion of our UFs for now, and we've been running into an issue a few times already, that I can't figure out. We've recently tested out a new path for data to flow into our Splunk environment from Universal Forwarders. ![]()
0 Comments
Leave a Reply. |
AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |