I read and used the steps mentioned in Dashboards Have Only Partial or No Data but I am not able to resolve an issue where I am missing at least Session Details. I have two endpoints in uberAgent. Server1 is missing some of the data and Server2 has all of the expected data. The servers are behind different firewalls and I confirmed port 19500 is open to the Splunk host.
Windows 2008R2 endpoint servers. Splunk 6.3 and uberAgent 3.6.
Any suggestions please?
I appreciate your support on the issue and you have a great product.
After digging into this further, I am experiencing missing data on both of the servers. When I view Sessions -> User Sessions, I am missing users and I am comparing this with AppCenter where I have ten users active but the uberAgent User Sessions has two users listed. I checked the log files on the two XA servers where the uberAgent service is running and I see the missing users listed in the log. I am setup as standalone which is recommended. The Splunk server and the XA servers are all 2008 R2 servers.
I checked the KB article and I do not see the error in the log. I also checked for ReceiverStatistics and it is not in the log. I am assuming the only log is on the endpoints because I do not see one on the Splunk server.
The data is complete if the user is listed in User Sessions and the issue is that I am missing users. The users that are listed are not missing data. I also noticed that the missing users have logged into a XA session recently. For example, uberAgent displays the logon times from 8:07 and earlier but not the users that logged in after 8:07. I have 4 users that logged in after 8:07 and they are not in User Sessions and it was 8:40 when I noticed this.
I appreciate your assistance.