Getting Data In

splunk not receiving data from windows universal forwarder

skumarvs
New Member

Installed universal forwarder in windows. Checked the splunkd log and I could see the connection to server without any error as below. tried checking with firewall and ports.But still index doesnt log any events.

TcpOutputProc - Connected to idx=xxxx:9997.

Below are my conf file.

inputs.conf
[default]
host = xxxxx
[monitor:C:\opt\splunk\]
disabled = false
sourcetype = hievents
index = hiindex


Outputs.conf
[tcpout]
defaultGroup = default-autolb-group

[tcpout:default-autolb-group]
server = xxxx:9997

[tcpout-server://xxxx:9997]

Please advice.

Tags (2)
0 Karma

ankireddy007
Path Finder

Please check for monitor syntax: [monitor://]

MuS
SplunkTrust
SplunkTrust

Hi skumarvs,

here are some typical troubleshooting tips:

  • Do you search the correct time range - try all time?
  • Do you search the correct index - try index=hiindex?
  • Do you have permission to search this index?
  • search index=_internal source=*splunkd.log on the indexer for any error related to the universal forwarder
  • run a snoop/tcpdump to ensure there is something sent to the indexer, if the universal forwarder tells you it is connected that does not mean it sends data.

Last but not least do the usual troubleshooting around Splunk, is everything doing what it should do and so on.

hope this helps ...

cheers, MuS

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...