Getting Data In

Indexer isn't receiving data from the Universal Forwarder

tjohnson2
Explorer

Hello,

I'm having issues receiving data on my Indexer from the Universal Forwarder. Prior to installing the Universal Forwarder, I confirmed that the Indexer was able to receive data. However, after installing the Universal Forwarder and configuring according to Deployment instructions, I confirmed that the Forward-Server was "Active", Netstat was ESTABLISHED on both servers, the Inputs.conf and Outputs.conf files on the Universal Forwarder were configured to receive UDP Traffic and send traffic to the Indexer. For the purposes of troubleshooting, my OS Firewall has been turned off and I also confirmed that data is showing up in the index= _internal host=forward-server. Data is not updating in the Search Head. Does anyone have any ideas, or know of anything that has been missed.


FORWARDER

[root@SplunkForwarder bin]# ./splunk list forward-server
Active forwards:
10.202.192.33:9997
Configured but inactive forwards:
None


[root@SplunkForwarder local]# more inputs.conf
[default]
host = Splunk_Forwarder

[udp://5514]
index = pan_logs
sourcetype = pan_log
connection_host = ip
no_appending_timestamp = true
disabled = 1

[udp://514]

disabled = false

[root@SplunkForwarder local]# more outputs.conf
[tcpout]
defaultGroup = default-autolb-group

[tcpout:default-autolb-group]
server = 10.202.192.33:9997

[tcpout-server://10.202.192.33:9997]


INDEXER

[root@SplunkLinux bin]# ./splunk display listen
Receiving is enabled on port 9997.

0 Karma

tjohnson2
Explorer

Solved my issue by add the information in the location "$SPLUNK_HOME/etc/apps/search/local/inputs.conf"

This document is also a great resource: http://docs.splunk.com/Documentation/Splunk/6.2.3/Data/Useforwardingagentstogetdata

0 Karma

lguinn2
Legend

Is there really data arriving on port 5514 on the forwarder?

0 Karma

tjohnson2
Explorer

Just doubled-checked. If data is coming in, it's coming through the Indexer not from the Forwarder.

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...