Hi, I have configured a basic splunk instance and it is indexing locally. I wanted to add a universal forwarder from another linux server and have the *nix app forward to the indexer. I have configured a data input on the indexer on port 9997 which shows as active (I checked it with strobe from another machine).
I installed the universal forwarder on a different server and set up the indexer as the forward server. It shows as inactive.
/opt/splunkforwarder/bin # ./splunk list forward-server
Your session is invalid. Please login.
Splunk username: admin
Password:
Active forwards:
None
Configured but inactive forwards:
Any help is appreciated.
I used the wrong place to configure the receiving port. I needed to use Manager >> Forwarding and receiving >>Configure Receiving to configure it. It does now say that the forwarder is active.
I need to tell the forwarder what to send now, somehow.
Thanks!
[splunktcp://9997]
in inputs.conftelnet redactedservername 9997
from the forwardersfinally, read the logs in $SPLUNK_HOME/var/log/splunk/splunkd.log in both side.