Data Forwarding Issues
Issue-3:
The Forwarder is not sending data
Scenario-1:
No logs are sent by forwarder, even internal logs
Root Cause:
The forwarder is stopped due to a source server restart done by the Application team
Solution:
Enable boot start for forwarder, this will make sure the Forwarder is also started, after the source server restarted.
In Linux:
/opt/splunkforwarder/bin/splunk enable boot-start -user splunk