Hi,
I installed a heavy-forwarder, and will be monitoring some logfiles. I configured the inputs/outputs/props conf file and I restarted the forwarder, and it keeps telling me that "A splunktcp forwarder port is not configured in inputs.conf". I'm not looking to monitor any ports - why is it telling me that?
I see the same issue too. Is it something particular to Splunk 5?
I'm seeing the same message in my Universal Forwarder's log files as well.
This forwarder is only supposed to be reading local log files - not receiving events from any ports.
For now I'm ignoring the message.. but I'm still curious as to why it is showing up.
splunktcp is used by your receivers (indexers) that your forwarder is sending data to.
In your forwarder's outputs.conf , is the receiver host that you have specified correctly setup and listening on the splunktcp port ?