10-26-2013 16:39:13.343 +0100 WARN TcpOutputFd - Connect to 192.168.x.x:9997 failed. No connection could be made because the target machine actively refused it.

[russellrobertso]

I'm struggling to get Exchange Universal Forwarders to connect to the central instance.

This is the error in the splunkd log;

10-26-2013 16:39:13.343 +0100 WARN TcpOutputFd - Connect to 192.168.x.x:9997 failed. No connection could be made because the target machine actively refused it.

So trying a portqry on that port on that server and this is the response

Name resolved to 192.168.x.x

querying...

TCP port 9997 (unknown service): NOT LISTENING

Firewall on the central server is off and so not sure what the issue is here.

Checking the Splunk services on the central server show the splunkd service running on 8089 and the web service running on 8000.

Am I missing a service or should I be pointing to 8089?

This is a new central server install on Server 2012 R2, Splunk V6. Exchange is 2010 and installed SP2 just for Splunk.

[kcooper]

how about if we are still using 5.0.6? How is this fixed?

[somesoni2]

Same steps.

[ShaneNewman · Accepted solution]

Log into your indexer. If you are using 6.0 then click settings in the upper right hand corner, then forwarding and receiving. Under receive data click on configure receiving. Then add new, type 9997 - save.

[russellrobertso]

Hello

Excellent, this has fixed.

Thanks

Russell

[ShaneNewman]

Did this help or is that not the problem?