Forwarders

This topic is a reference for the Forwarders: Deployment, Forwarders: Instance, and the Splunk TCP Input Performance deployment and instance dashboards in the Monitoring Console. See About the Monitoring Console in this manual.

What do these views show?

The Monitoring Console monitors forwarder connections (in the Forwarders dashboards) and communication (in the Splunk TCP Input dashboards).

The Splunk TCP Input views monitor Splunk TCP Inputs, that is, data from one Splunk instance to another. Usually this is a forwarder sending data to an indexer. These views do not monitor TCP input from a non-Splunk device to a collector, like an Apache server sending its logs to a forwarder.

Interpret results in these views

Forwarders: Deployment view

The Status panel can show the value "active" or "missing". When the scheduled search runs to update this panel, it looks back 15 minutes. If a forwarder connects to the indexers in those 15 minutes, then its status is "active." If not, its status is "missing." To permanently remove missing forwarders from your dashboards, rebuild the forwarder asset table. See Configure forwarder monitoring in this manual.

This lookback time is different from the data collection interval (in Settings > Forwarder Monitoring Setup), which is how often that scheduled search runs. Read about time settings in Configure forwarder monitoring in this manual.

In the Status and configuration panel, the time shown is the last time that the scheduled search completed.

Forwarders: Instance view

The quantity called "outgoing data rate" measure the data received by an indexer from a forwarder. This measurement comes from metrics.log on the indexer. See About metrics.log in the Troubleshooting Manual.

If you can't find your indexed data in Splunk Enterprise, you can look at Monitoring Console dashboards in this order:

1. Forwarder views.

2. Splunk TCP input views.

3. Indexing views.

See Troubleshoot forwarder/receiver connection in the Forwarding Data manual.

What to look for in these views

Start at the Forwarders: Deployment view to see whether your forwarders are reporting as expected, or whether one of them is missing.

This dashboard is paired with a preconfigured platform alert, which can notify you when one or more forwarders is missing.

Troubleshoot these views

Forwarders and Splunk TCP Input dashboards

If these dashboards lack data, verify that you have completed all of the setup steps for the Monitoring Console, in either distributed or standalone mode.

Like all Monitoring Console dashboards, these dashboards need metrics.log from the indexers. The Monitoring Console does not query forwarders directly for data, but rather gets its data from the indexers that the forwarders connect to.

Steps specific to the Forwarders dashboards

For any of the Forwarders: Deployment or Forwarders: Instance dashboard panels to work, you must follow the setup steps in Configure forwarder monitoring in this manual. Note the prerequisite that the historical panels need forwarders with individual GUIDs.

Averages on the Forwarders dashboards are not calculated until at least one of the "data collection intervals" (as defined in Monitoring Console > Settings > Forwarder monitoring setup) elapses.