Getting Data In

heavy forwarder configuration

rriley
New Member

I want to configure a server as a heavy forwarder. I'm not clear that I understand how to ship the logs from the heavy forwarder to the indexer. Does an input have to be configured on the forwarder?

Seems my indexer is listening on the configured port 5000 okay.

At this point, I have configured the forwarder with defaults (except I'm using port 5000). The same for the receiving indexer (port 5000 again.) But I am not getting any data from the heavy forwarder... does an input have to be configured on the forwarder????

Splunkd.Log says something is wrong with SSL ( which I did not configure)

Is there a complete configuration guide for forwarders? The documentation seems so inadequate to completely describe the steps to set this up...

04-12-2011 13:11:08.603 ERROR TcpInputFd - SSL Error = error:00000000:lib(0):func(0):reason(0) 04-12-2011 13:11:08.603 ERROR TcpInputFd - ACCEPT_RESULT=0 VERIFY_RESULT=0 04-12-2011 13:11:08.603 ERROR TcpInputFd - SSL Error for fd from HOST:(myhost name)

thanks in advance.

Tags (2)
0 Karma

mamaral
Path Finder

Hi, here in mine environmental i've more than 600 universal forwarders sending data to 2 heavy forwarder. So try it this:


outputs.conf on heavy forwarder

[tcpout:LB_indexers]

autoLB=true

server=IP INDEXER A:5000,IP INDEXER B:5000

autoLBFrequency=7

[tcpout]

defaultGroup=LB_indexers

disabled=false


inputs.conf on heavy forwarder

[splunktcp://7700]


inputs.conf on indexer

[splunktcp://5000]


outputs.conf on universal forwarder

[tcpout:LB_forwarders]

autoLB=true

server=IP HEAVY FORWARDER A:7700,IP HEAVY FORWARDER A:7700

autoLBFrequency=7

[tcpout]

defaultGroup=LB_forwarders

disabled=false


AMARAL

fabiocaldas
Contributor

Thanks for your anwser and I just would like to remember everyone to restart splunk after setup files.
Again, thanks your anwsers were perfect.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...