Troubleshooting • Room 2

Data Flow Issues

Common data flow issues: Forwarder cannot reach indexer (check `outputs.conf`, firewall rules, port 9997). Indexer receives data but events are malformed (check `props.conf` parsing).

License violations occur when daily indexed volume exceeds the license quota. Five violations in a 30-day rolling window creates a "license violation state" that blocks search.

Knowledge Check

Prove your understanding to clear the room (Rewards XP)

Drag items to their correct zone (or tap item then tap zone on mobile)

Forwarder config defining target indexer(s)

Primary Splunk daemon log for errors

Shows connected forwarders and their data flow

Validates effective config from all layers

outputs.conf

splunkd.log

tcpin_connections

btool