Getting Data In

Splunk storm forwarder indexer configuration

lsudarshan
New Member

Hello all,

I am a novice splunk storm user and just installed the universal forwarder. But the installation expects a indexer ipaddress. I assumed as I was using splunk storm that I don't need to give this... its known by the installation. After installation, I ran the command "splunk.exe list forward-server" and get :

Active forwards:
        None
Configured but inactive forwards:
        forwarder.splunkstorm.com:9997

I tried telneting to forwarder.splunkstorm.com at port 9997 but that fails. Is this something to setup in splunk storm itself?

Appreciate any help.

Thanks,
Sudarshan

0 Karma

colares
Engager

I've solved this by allowing the port 9997 on firewall.

sudo ufw allow 9997
0 Karma

lsudarshan
New Member

Thanks sdaniels. Will try these suggestions.

0 Karma

ChrisG
Splunk Employee
Splunk Employee

Did you start by downloading the credentials package from within your Splunk Storm project? See Set up a universal forwarder on Windows in the Splunk Storm documentation.

lsudarshan
New Member

Thanks Chris... will try it out.

0 Karma

ChrisG
Splunk Employee
Splunk Employee

Hm, then yeah, your firewall might be blocking something, or you might have a port issue from some setting in the AWS management console (see the first posting sdaniels listed). And you need to tell the forwarder what to monitor (see YannK's answer in the second posting that sdaniels listed). Beyond that, someone with deeper knowledge is going to have to help you here!

lsudarshan
New Member

Thanks for the answer Chris. I did indeed install the credentials package which created an app under the forwarder. But the command "splunk.exe list forward-server" still gives :

Active forwards:
None
Configured but inactive forwards:
forwarder.splunkstorm.com:9997

The curious thing is I can't telnet to forwarder.splunkstorm.com at port 9997.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...