Why is Universal Forwarder not forwarding? Standard install and all default configuration.

[neiljpeterson]

My installation of the Spunk is right out of the box, standard. I followed all the documentation to the letter, used all recommended settings, groups, names, ports, etc.

In the Splunk interface I configured receiving to listen to 9997. And I installed the Deployment Monitor app.

I installed the Universal Forwarder on a remote host and selected all the inputs and a directory with a log file. All other the defaults used (also using 9997)

I verified that the server is reachable and listening on the correct port from the remote host.

After all this the Deployment monitor still says No forwarders and no data is available in search.

What am I missing here?

[neiljpeterson · Accepted solution]

So I found that the host I was trying to receive data from had been set (possibly inadvertently by me or perhaps by someone else >:|) as another indexer to also send data to. I guess this caused a conflict in some way?

After I removed that configuration and restarted Splunk the host's data is now showing up!

[lukejadamec]

Beware the 'other' admins.

[lukejadamec]

Restart the forwarder from a cmd window (run as admin) with the "c:\program files\splunkuniversalforwarder\bin\splunk.exe restart" command and look for errors. If there are none, then shortly after the restart look for errors in the splunk\var\log\splunk\splunkd.log file.

[neiljpeterson]

During the installation of UF? Yes I did, I selected all of them and a log file. Changed the post to reflect this.

[Ayn]

Did you actually add any inputs for the UF to read data from?