About cfernaca

cfernaca · ‎01-16-2025

Hi, I have a indexers cluster with 4 indexers. All indexers have 8.1.14 splunk version. The OS of servers are RedHat 7.9. The indexers cluster are multisite. We have two sites. Each of sites have two server associated. In addition, we have a cluster manager, search heads cluster, development search head, development indexer and deployment server. All instances have splunk 8.1.14. I see the Splunkd Thread Activity looking for possible clues to a problem we have when indexing data in production. The problem is that sometime we don't have some events in production. Not matter what sourcetype or method used to ingest data. We suspect that can be problem of indexers or of index where data is ingested.

cfernaca · ‎01-16-2025

Hi, I have a indexers cluster with 4 indexers. All indexers have 8.1.14 splunk version. The OS of servers are RedHat 7.9. The indexers cluster are multisite. We have two sites. Each of sites have two server associated. In addition, we have a cluster manager, search heads cluster, development search head, development indexer and deployment server. All instances have splunk 8.1.14. I see the Splunkd Thread Activity looking for possible clues to a problem we have when indexing data in production. The problem is that sometime we don't have some events in production. Not matter what sourcetype or method used to ingest data. We suspect that can be problem of indexers or of index where data is ingested.

cfernaca · ‎01-16-2025

Hi, Looking at the activity of the Splunkd threads on the indexers, I've seen in the monitoring console that sometimes there is no activity for a period of 1 minute. Is this normal? evidence Regards, thank you very much

cfernaca · ‎02-13-2024

No, exactly. I have configure two tcpout groups, one for the production servers and the other for development server. The data is not sent to two tcpout groups, only is sent to one. However, the internal agent logs yes it sent to development and production tcpout groups. It’s possible that the internal agent logs have the behavior you mention?

cfernaca · ‎02-07-2024

Mark in your serverclass restartSplunkd to "true" for the app(s) you're deploying

cfernaca · ‎02-07-2024

Good morning, Let me tell you about my situation. We have a forwarder inside a Docker container python:3.11-slim-bullseye. We've noticed that when we deploy an application from the deployment server to the forwarder by adding a stanza to the inputs.conf file, the forwarder's ExecProcessor doesn't detect the change. Could you please help me understand why? Thank you very much, regards.

cfernaca · ‎02-07-2024

Good morning, Let me tell you about my case. In my company, we have five indexers, one for development and the other four for production. We have an inputs.conf in a forwarder inside a Docker container python:3.11-slim-bullseye that has three stanzas that execute a script with arguments. One stanza sends the data to development and runs every two minutes, and the other two send the data to production, one running every minute and the other every two minutes. We have noticed that during a period of time last night, we did not receive any data from the forwarder. Regarding the development stanza, it's correct as the machine was being patched, and Splunk was stopped just during that period. We have observed that during those hours, the forwarder did not execute any scripts. During that time frame, we found these traces in the watchdog.log file of the forwarder: 02-05-2024 20:02:18.220 +0000 ERROR Watchdog - No response received from IMonitoredThread=0x7fabb87fec60 within 8000 ms. Looks like thread name='ExecProcessor' tid=1937852 is busy !? Starting to trace with 8000 ms interval. Could you please help me understand why the forwarder did not execute any scripts during that time frame? Thank you very much. Best regards.

cfernaca · ‎10-07-2019

Perfecto, muchas gracias !!

Posts	9
Solutions	1
Karma Given	0
Karma Received	0
Member Since	‎10-07-2019

Online Status	Offline
Date Last Visited	‎01-16-2025 06:20 PM

No activity in Splunkd Threads on indexer

ExecProcessor of the forwarder doesn't detect new ...

Splunk forwarder does not run any script for a per...

Re: No activity in Splunkd Threads on indexer

Re: No activity in Splunkd Threads on indexer

No activity in Splunkd Threads on indexer

Re: Splunk forwarder does not run any script for a...

Re: ExecProcessor of the forwarder doesn't detect ...

ExecProcessor of the forwarder doesn't detect new ...

Splunk forwarder does not run any script for a per...

Re: Count of values in from values() function

Are you a member of the Splunk Community?