Getting Data In

Universal forwarder and Indexer and not able to handshek and are not working

vagish_dwivedi
New Member

Hi,

I am trying to setup splunk to send my local system's data to remote indexer, however its not working, logs coming in splunkd.log file are as below:

Universal Forwarder logs:
06-17-2012 22:02:17.364 +0530 INFO TcpOutputProc - Connected to idx=IP.Address:9997
06-17-2012 22:02:17.750 +0530 INFO TcpOutputProc - Connection to IP.Address:9997 closed. Connection closed by server.
06-17-2012 22:02:17.750 +0530 WARN TcpOutputProc - Applying quarantine to idx=IP.Address:9997 numberOfFailures=14
06-17-2012 22:02:22.764 +0530 WARN DeploymentClient - Unable to send handshake message to deployment server. Error status is: not_connected

Remote system(Indexer logs):
06-01-2012 14:32:19.548 +0530 WARN DeploymentClient - Unable to send handshake message to deployment server. Error status is: not_connected
06-01-2012 14:32:21.523 +0530 WARN TcpOutputProc - Raw con˜Ô‚8³Cp~! from src=14.99.150.3:51925

My inputs.conf in local system(Universal forwarder) is as below:

[monitor://C:\apache-activemq-5.5.1-bin\apache-activemq-5.5.1\data\activemq.log]
source=VagishPC
sourcetype=activemq_log
ignoreOlderThan = 70d
disabled = false

Can ayone help me, what I am missing here?

Thanks,
Vagish

Tags (1)
0 Karma

vagish_dwivedi
New Member

Hi,

I think there is non ssl connection between forwarder and receiver, in receiver machine I see the log coming as: Initializing connection for non-ssl forwaring to xx.xx.xx.xx:9997
06-10! from src=xx.xx.xx.xx:51352.

Also I have checked outputs.conf file of forwarder and inputs.conf file of receiver, however didn't see any ssl information.

0 Karma

Ayn
Legend

This sounds like you're trying to setup a non-SSL connection to an indexer that expects SSL, or compressed SSL to an indexer that expects non-compressed, or vice versa. You should check your settings in outputs.conf on the forwarder, and inputs.conf on the indexer.

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...