Getting Data In

Unable to get universal forwarder to become active - Linux

jplangan
New Member

Hi, I have configured a basic splunk instance and it is indexing locally. I wanted to add a universal forwarder from another linux server and have the *nix app forward to the indexer. I have configured a data input on the indexer on port 9997 which shows as active (I checked it with strobe from another machine).

I installed the universal forwarder on a different server and set up the indexer as the forward server. It shows as inactive.
/opt/splunkforwarder/bin # ./splunk list forward-server
Your session is invalid. Please login.
Splunk username: admin
Password:
Active forwards:
None
Configured but inactive forwards:
:9997

Any help is appreciated.

Tags (1)
0 Karma

jplangan
New Member

I used the wrong place to configure the receiving port. I needed to use Manager >> Forwarding and receiving >>Configure Receiving to configure it. It does now say that the forwarder is active.

I need to tell the forwarder what to send now, somehow.

Thanks!

0 Karma

yannK
Splunk Employee
Splunk Employee
  • The unix inputs goes to the "os" index by default, check in every indexes with index=*.
  • the UF have a slow thruput by default, it may still be forwarding old logs.
  • when you opened the port 9997 on the indexer, was it as tcp ( in the inputs manager), or as splunktcp (in the forward and received manager) ? The correct one is the second and look like [splunktcp://9997] in inputs.conf
  • no firewall ? try a telnet redactedservername 9997 from the forwarders

finally, read the logs in $SPLUNK_HOME/var/log/splunk/splunkd.log in both side.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...