Getting Data In

Why can't the Splunk server index or show events forwarded by windows host with universal forwarder?

josue198_s
New Member

alt text
I have installed universal forwarder on my windows host and the forwarder does forward the events to the Splunk server on port 997.
As you can see in the wireshark picture the Splunk server recognizes the windows forwarder, but on the search, it can't seem to find any events related to windows or the windows host.
What am I doing wrong?

0 Karma

s2_splunk
Splunk Employee
Splunk Employee

Can you share your inputs.conf from the Windows system?
What index are you sending the data into?
Did you specify that index when searching?
Have you checked your splunkd.log on the indexer (index=_internal sourcetype=splunkd) for any error messages?
Have you looked through the documentation on "Where is my data?"

Have you tried running index=* host=DevilMayCry or how are you searching for the data?

0 Karma

p_gurav
Champion

Whats the output for below command:

C:\SplunkForwarder\bin\splunk list forward-server
0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...