Port on the server and the network seems open for 9998 port for indexers to receive data but only 1 out of the 3 indexer is able to get data from forwarder service.
Is there anything on the console I need to ensure that 9998 port is open and Splunk can receive data from forwarders.
Must not be blocked by firewall on either end. Must be route from forwarder to Indexer. ACL must be OK. Forwarder's outputs.conf
must have all 3 Indexers defined. All Indexers must have the same inputs.conf
settings. Try splunk list inputstatus
on each Indexer and compare.
Must not be blocked by firewall on either end. Must be route from forwarder to Indexer. ACL must be OK. Forwarder's outputs.conf
must have all 3 Indexers defined. All Indexers must have the same inputs.conf
settings. Try splunk list inputstatus
on each Indexer and compare.
Thanks Woodcock
It seems you have a solution for me....I fired the command on all the 3 indexers we have and only one server showed below result.
tcp_cooked:listenerports :
9997
9998
Else for this other 2 indexer in cluster show
tcp_cooked:listenerports :
9997
Now please suggest where is the setting from where I can get the 9998 port opened.
Thanks a lot for the initial finding help.
Thanks.
Vikram.
Yes you can add another listening port by either:
a) Using the GUI by going to Settings
-> Data Inputs
-> TCP
-> New
b) Using the command-line command, ./splunk enable listen 9998 -auth admin:change me # Needs option for SSL
c) editing the inputs.conf file and adding a new stanza like this:
[splunktcp-ssl:9998]
compressed = true
See this documentation:
http://docs.splunk.com/Documentation/Splunk/latest/Deploy/Aboutforwardingandreceivingdata
Regarding SSL encryption, you need to decide whether you want to use your own certificates or the ones supplied by Splunk. I suggest you read this:
http://docs.splunk.com/Documentation/Splunk/latest/Admin/UseSSLtoencryptandauthenticatedatafromforwa...