Getting Data In

Forwarder is not showing in Splunk

shivanshuk
Explorer

Hi Splunk Team,

We have installed splunk tool on a windows server 2003 machine say A and Splunk forwarder on another windows server 2008R2 machine say B. Following default ports have been opened between them. 9997,8089 ,8000

The above ports are opened only as outbound connectivity from source to destination.

We have checked the input and output configuration files too. However we are still unable to detect the forwarder in the splunk tool.
Please see the below conf files and snapshot of log files too. Let us know if anything else is required.

Input.conf (splunk from Machine A)

[default]
host = <machine A>

# added from below

[tcp://<machine B IP >:9997]
disabled = 0

`[tcp]
acceptFrom=*

connection_host=ip`

Pls see error msg in splunkd log from machine B where forwarder is installed.

03-20-2013 10:25:19.465 -0400 WARN DeploymentClient - Unable to send handshake message to deployment server. Error status is: rejected
03-20-2013 10:25:31.477 -0400 WARN DeploymentClient - Unable to send handshake message to deployment server. Error status is: rejected
03-20-2013 10:25:43.490 -0400 WARN DeploymentClient - Unable to send handshake message to deployment server. Error status is: rejected
03-20-2013 10:25:55.502 -0400 WARN DeploymentClient - Unable to send handshake message to deployment server. Error status is: rejected
03-20-2013 10:26:07.514 -0400 WARN DeploymentClient - Unable to send handshake message to deployment server. Error status is: rejected
03-20-2013 10:26:16.702 -0400 WARN PubSubConnection - Cannot convert str: to a valid status, returning eRejected.

Please HELP. Thanks in advance.

Thanks
Shivanshu

Tags (3)
0 Karma

shivanshuk
Explorer

All,

I have solved this issue by reinstalling the splunk and forwarder, something was messed up on my outputs.conf . 🙂

0 Karma

piebob
Splunk Employee
Splunk Employee

you must configure the outputs.conf on the forwarder. you must create this file if it does not exist. here is some introductory information about how configuration files work in general in Splunk: http://docs.splunk.com/Documentation/Splunk/latest/Admin/AboutConfigurationFiles

0 Karma

shivanshuk
Explorer
  1. I havent done any changes in output.conf file on forwarder. moreover couldnt find any output.conf at below location - \etc\system\local
    Hence i have copied the default output .conf from default to local.

  2. could find below error in splunkd logs
    03-20-2013 05:20:23.449 -0400 ERROR TcpOutputProc - LightWeightForwarder/UniversalForwarder not configured. Please configure outputs.conf.

0 Karma

jrodman
Splunk Employee
Splunk Employee

Incidentally, those warnings are not related to your forwarder problem, unless they are just both indications of a network problem.

jrodman
Splunk Employee
Splunk Employee

If you're trying to set up forwarding you should:
1 - show the outputs.conf configuration on the forwarder
2 - show any messages in splunkd.log on the forwarder about TcpOutput
3 - verify that when you send a packet to 9997 on the receiver that it gets there (for example network sniff on indexer.)

0 Karma

bmacias84
Champion

Are you referring to forwarding data to Indexer or a Deployment Server. The Warning you have posted are related to Splunk Deployment Server not inputs.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...