Free version Error

[jaymehta18]

I am using a free version of Splunk indexer and forwarder. I could see 2 log files on indexer which came from forwarder. But after that I could not find anything else. I made some changes on forwarder to see if indexer brings those changes. But it did not.

In log file of indexer, I found this ERROR(this was the last line of log file):

ERROR ApplicationUpdater - Error checking for update via https://splunkbase.splunk.com/api/apps:resolve/checkforupgrade: Connect timed out.

Is there a limit on the amount of data i could see on indexer or limit on number of files?
what should I do to make it work?

Currently we are in POC stage and if we find this useful, we would be going for a licensed version, but for this its not letting us do anything now.

[gelica]

@jaymehta18
How did you solve this? The same problem suddently apperad to me earlier today...

@kristian.kolb
I just wonder if you have any other suggestion on how to solve this problem?

I have done everything you suggested in you answer.

On the search summary page, Splunk tells me that it has indexed 410 events from different sources with different sourcetypes as it should.
When running a search for * Splunk tells me that it found 410 matching events, but I can't see them, and none of the fields is showing either.

[kristian_kolb · Accepted solution]

This was getting too big for a comment, so it became an answer instead. Some things to check;

1. Did you find any other errors in splunkd.log?
2. Are you sure that events are being created, that the forwarder could send to the indexer?
3. Are you monitoring the correct file(s)?
4. Do you have permissions to read the file?
5. What changes have been performed since it actually worked?

6. How do you know that it isn't working?

   • Have you searched for "all time"?
   • Have you checked that you are sending events to the right index?
   • Do you have permissions to see that index?
   • Is that index searched by default?

7. Make a metadata search (yes, it starts with a pipe).

   | metadata type=hosts | eval lastTime = strftime(lastTime, "%Y-%m-%d %H:%M:%S")

That should give you the time when the host sent data lastTime.

That's all I can think of for now. Best of luck.

/kristian

[jaymehta18]

Hi Kristian,

I found the error i mentioned in the log file. From the licensing link i can find that i still have no alerts on licensing front, so that should be OK.

With telnet, it says its connected on port 9997. That is fine too. This is getting wierd as suddenly it has stopped working.

Regards,
Jay

[kristian_kolb]

You can see that in the Manager page (link in the top right corner), under Licensing.

Can you connect to the indexers listening IP:port from the forwarder by other means, like telnet?

Have you checked the splunkd.log on the forwarder? You'll find it in /opt/splunk/var/log/splunk. That's where a lot of error messages regarding splunk will go.

/k

[jaymehta18]

Hi Kristian, thanks for the answer. How can i check how much amount of data has been indexed in a single day?

BTW, i was not getting that error before (today morning indexing was working fine), once i started this error, i am not able to see any indexing happening.

Regards,
Jay

[kristian_kolb]

The error message just says that your splunk instance can't connect to splunk.com. Nothing to do with your forwarding problems, unless you've accidentally changed a firewall somewhere.

There are no limits for presentation of already indexed data. There are no limits regarding how many files you can monitor.

The only limit is the amount of data that can be indexed per day, wich is 500 MB, both for Splunk Free and Splunk Enterprise Trial.