Need help to configure indexer and forwarder. This what i have done till now.
But somehow i don't see my forwarder machine under "Search" though log file was mentioned in splunkd logs, not sure what is the problem. Please advise or forward it Splunk support if needed. Thanks
Below is the config changes done so far.
1- on indexer side (cfcmslxdev01.lehman.com), splunk web->manager->forwarding and receiving->receive data: add new. Specify a TCP port (I use 9997). Save and restart
2. On Forwarder (server sgppsr00346)
/apps/splunkforwarder/etc/system/local/inputs.conf
[default]
host = sgppsr00346.intranet.barcapint.com
[monitor:///home/cetprod/TTV2Container/prod_apem/EMOfferingOverlay/log/*.log]
_TCP_ROUTING = GroupName
disabled=false
index=test
/apps/splunkforwarder/etc/system/local/outputs.conf
[tcpout]
defaultGroup = GroupName
[tcpout:GroupName]
server = 10.56.112.114:9997
[tcpout-server://10.56.112.114:9997]
Please advise, Thanks
I don't think that this line is needed:
[tcpout-server://10.56.112.114:9997]
If you're forwarding everything from the server you don't need the line:
_TCP_ROUTING = GroupName
When looking for the data in the test index have you checked the following:
Its probably better to use a more descriptive name than 'GroupName' for your forwarding group.
I don't think that this line is needed:
[tcpout-server://10.56.112.114:9997]
If you're forwarding everything from the server you don't need the line:
_TCP_ROUTING = GroupName
When looking for the data in the test index have you checked the following:
Its probably better to use a more descriptive name than 'GroupName' for your forwarding group.
Thanks for help. There was typo in index creation. But you guided me to resolve this. Thanks
Thanks a lot!
I had a similar problem.