Hey guys,
I have configured the forwarder to send apache access logs to itself from localhost. However, when I look at the metrics log for Splunk, I see
01-07-2016 19:34:57.279 +0000 INFO StatusMgr - destHost=xx.xx.xxx.xxx, destIp=xx.xx.xxx.xxx, destPort=9997, eventType=connect_try, publisher=tcpout, sourcePort=8089, statusee=TcpOutputProcessor
01-07-2016 19:34:57.280 +0000 INFO StatusMgr - destHost=xx.xx.xxx.xxx, destIp=xx.xx.xxx.xxx, destPort=9997, eventType=connect_fail, publisher=tcpout, sourcePort=8089, statusee=TcpOutputProcessor
My inputs.conf file is inside of /opt/splunk/etc/apps/search/local/inputs.conf
, and it says -
[splunktcp://9997]
connection_host = ip
[monitor:///var/log/apache2/access.log]
disabled = false
index = main
sourcetype = access_combined
I'm pretty sure I already opened port 9997. When I do it inside of Splunk, it says the port is already open.
Any help would be appreciated.
Thanks
The issue was that the forwarder and the receiver were on the same server, so it was causing a feedback loop and not allowing and new indexes to be processed. Removing the forwarder and all of the configuration relating to it from the server that the receiver was on fixed the issue.
The issue was that the forwarder and the receiver were on the same server, so it was causing a feedback loop and not allowing and new indexes to be processed. Removing the forwarder and all of the configuration relating to it from the server that the receiver was on fixed the issue.