Configured but Inactive Forwards, inspite of resolving Firewall issue. Why?

[smk54]

Hello

I am trying to configure a forwarder between a Linux Machine and a Windows machine. My Splunk is installed on the windows and the forwarder on Linux. I need to establish a connection between both so as to monitor the syslogs.

I have followed all the steps mentioned in "http://answers.splunk.com/answers/50082/how-do-i-configure-a-splunk-forwarder-on-linux.html" to configure the forwarder. But when i try to list the forwards, it says
Configured but inactive forwards:
137.254.237.30:9997
(the ip of my windows machine:port)
By doing more research I came to know that this could a firewall issue. I restarted the Windows firewall and added this port as an Inbound Rule for Splunk. But still, the forwarder is inactive.

Please help me out on this.

[miteshvohra · Accepted solution]

There is a high possibility that the data you wish to forward is already sent and there is no more new data to be sent.

Try generating some events or run this eventgen to produce random samples, and then check the status.

Regards, Mitesh.

[Herman]

But what about universal forwarder? Could you install eventgen add on for universal forwarder? I have tried but no luck.

Have looked through several posts and checked everything, still having the forwards inactive.

Any help appreciated

[smk54]

Thanks a lot mitesh 🙂

I guess its a bug in version 5.0.4. The data had already been forwarded, however, the forward was still shown as inactive.

I would like to know one more thing. How can we remove the inactive forwards from that list in Linux? I deleted all the saved ones through the Splunk Web. But, the list is still appearing in Linux.