Hi all,
I have just started to implement splunk in my network. I have few servers, but I would like to start with Unix machines.
I have donwloaded and installed main server and it looks fine.
The problem starts when it goes to forwarder...
I have updated following file:
/opt/splunkforwarder/etc/apps/SplunkUniversalForwarder/default/outputs.conf
[tcpout]
maxQueueSize = 500KB
indexAndForward=true
[tcpout:fastlane]
server = 10.251.1.1:6996
sendCookedData = false
When I put command: /opt/splunkforwarder/bin/splunk list forward-server
Active forwards:
None
Configured but inactive forwards:
10.251.1.1:6996
How do I enable this forward mode ??
I have also tried:
[splunk@CentOS01 splunkforwarder]$ /opt/splunkforwarder/bin/splunk enable app SplunkLightForwarder
In handler 'localapps': Application does not exist: SplunkLightForwarder
Any help from you would be nice 🙂
Did you enable receiving on the indexer? Splunk doesn't listen for forwarded inputs by default.
https://docs.splunk.com/Documentation/Forwarder/7.0.1/Forwarder/Enableareceiver
This is iptables rules problem I solved it by running following command ;
iptables -I INPUT -p tcp -m state --state NEW -m tcp --dport 9997 -m comment --comment "splunk remote Listener" -j ACCEPT
Refer this page for more
qf@qan0030:~> /opt/splunkforwarder/bin/splunk list forward-server
Active forwards:
None
Configured but inactive forwards:
sdvl5qtm001.td.teradata.com:8089
sdvl5qtm001:9997
I am also seeing the same problem, Please help me out how to resolve this issue.
my active forwards are none.
You're having a UniversalForwarder and want to send data to another forwarder "HeavyForwarder" right? The command splunk list forward-servers
shows you only, if the connection from UniversalForwarder to "HeavyForwarder" has been established. In this case there is no established connection - HeavyForwarder does not accept input from your UniversalForwarder!
Make sure you've setup receiving on server 10.251.1.1 (incl. listening on port 6996) correctly. While starting up your UniversalForwarder open on both (UniversalForwarder & HeavyForwarder) servers the logfiles -> $SPLUNK_HOME/var/log/splunkd.log
What does the log telling you?