I have multiple LAMP servers that I am looking to monitor with Splunk. I got my server setup last Friday and setup the Universal forwarder on a couple of VM's that i am using for testing. The problem is that these hosts do not show up on my server.
I am running the configs from the *nix module on my forwarder test systems and was expecting them to show up when I was viewing the os index. Unfortunately, I only see a single host.
I have verified that the forwarder is connecting to the server. A quick view of tcpdump output shows that information is being sent, but I am not sure what the server is doing with it; as the UI only shows the index server host and no others.
Am I missing something basic here?
... View more