Getting Data In

Why are we unable to send collection logs on Universal forwarder to both old and new indexers?

OMohi
Path Finder

Hi

we have a client who wants to migrate sending network devices logs from his universal forwarder server from his POC (search head + indexer) servers to our prod indexers.

But when I point the name of the prod indexers on outputs.conf file under /opt/splunkforwarder/etc/system/local/outputs.conf:

outputs.conf:
[tcpout:indexers] 
server=193.91.168.181:9997,205.145.98.20:9997 

[tcpout] 
defaultGroup=s05 

[tcpout:S05] 
server=LOUWEBWPL20S02:9997,LOUWEBWPL20S03:9997 

autoLB = true 
autoLBFrequency = 31 
forceTimebasedAutoLB = true 
useACK = true

The log collection stops on the orginal POC servers as well as on new indexers there is no data coming.

What am I missing here?

My prod indexer servers are :

LOUXXXWPLXXS02:9997
LOUXXXWPLXXS03:9997

and their POC indexer servers are :

190.XX.XXX.XXX:9997,202.XXX.XXX.XX:9997

Why am I unable to do load balancing?

Thanks,

Mohammed 

0 Karma
1 Solution

jayannah
Builder

Hi

The below change should work for you. I have made 2 corrections.
1. S05 ==> s05 (Upper case 'S' to lower case 'S')
2. defaultGroup=s05 ==> defaultGroup=s05, indexers (This is required to send the same data to both set of indexers)

check and let me know.

               outputs.conf:

                [tcpout] 
                defaultGroup=s05, indexers 

                [tcpout:indexers] 
                server=193.91.168.181:9997,205.145.98.20:9997 

                [tcpout:s05] 
                server=LOUWEBWPL20S02:9997,LOUWEBWPL20S03:9997 
                autoLB = true 
                autoLBFrequency = 31 
                forceTimebasedAutoLB = true 
                useACK = true

=====
Above configuration will work, Incase if the above configuration doesn't work, the check the following
1. User IP address for servers incase if DNS resolution creates problem due to firewall
2. Ensure there are no firewall restrictions
3. Ensure port 9997 opens on indexed (receiver side)

View solution in original post

jayannah
Builder

Hi

The below change should work for you. I have made 2 corrections.
1. S05 ==> s05 (Upper case 'S' to lower case 'S')
2. defaultGroup=s05 ==> defaultGroup=s05, indexers (This is required to send the same data to both set of indexers)

check and let me know.

               outputs.conf:

                [tcpout] 
                defaultGroup=s05, indexers 

                [tcpout:indexers] 
                server=193.91.168.181:9997,205.145.98.20:9997 

                [tcpout:s05] 
                server=LOUWEBWPL20S02:9997,LOUWEBWPL20S03:9997 
                autoLB = true 
                autoLBFrequency = 31 
                forceTimebasedAutoLB = true 
                useACK = true

=====
Above configuration will work, Incase if the above configuration doesn't work, the check the following
1. User IP address for servers incase if DNS resolution creates problem due to firewall
2. Ensure there are no firewall restrictions
3. Ensure port 9997 opens on indexed (receiver side)

OMohi
Path Finder

Thanks for your time on investigating this issue. You were right on. I forgot to mention two target group as my default group. Also there was a typo in one of the default group S for s.

This assisted me in troubleshooting the matter.

Thanks Again !!

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...