Getting Data In

Why are Apache access logs not appearing after configuration and ogs show the server is rejecting the connection between itself?

Spiere
Path Finder

Hey guys,

I have configured the forwarder to send apache access logs to itself from localhost. However, when I look at the metrics log for Splunk, I see

01-07-2016 19:34:57.279 +0000 INFO  StatusMgr - destHost=xx.xx.xxx.xxx, destIp=xx.xx.xxx.xxx, destPort=9997, eventType=connect_try, publisher=tcpout, sourcePort=8089, statusee=TcpOutputProcessor
01-07-2016 19:34:57.280 +0000 INFO  StatusMgr - destHost=xx.xx.xxx.xxx, destIp=xx.xx.xxx.xxx, destPort=9997, eventType=connect_fail, publisher=tcpout, sourcePort=8089, statusee=TcpOutputProcessor

My inputs.conf file is inside of /opt/splunk/etc/apps/search/local/inputs.conf, and it says -

[splunktcp://9997]
connection_host = ip

[monitor:///var/log/apache2/access.log]
disabled = false
index = main
sourcetype = access_combined

I'm pretty sure I already opened port 9997. When I do it inside of Splunk, it says the port is already open.

Any help would be appreciated.

Thanks

0 Karma
1 Solution

Spiere
Path Finder

The issue was that the forwarder and the receiver were on the same server, so it was causing a feedback loop and not allowing and new indexes to be processed. Removing the forwarder and all of the configuration relating to it from the server that the receiver was on fixed the issue.

View solution in original post

0 Karma

Spiere
Path Finder

The issue was that the forwarder and the receiver were on the same server, so it was causing a feedback loop and not allowing and new indexes to be processed. Removing the forwarder and all of the configuration relating to it from the server that the receiver was on fixed the issue.

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...