- Splunk Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- Universal forwarder not forwarding to other linux/...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Universal forwarder not forwarding to other linux/windows
I have installed Uf in one linux and splunk instance in another linux/windows. While trying to configure , uf is not forwarding data to linux/windows splunk,ping is working fine.
Could you please help me on this.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi!
1) Try to restart frowarder
2) Check index = _internal for forwarder logs existence
If it is not working, please provide us full your outputs.conf config
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I would also check the _internal on the Splunk Indexer to see if you can see the UF host connecting to the Indexer. Is the host anywhere in the logs? It could be that the server is connecting but your app has an issue with it's input.conf
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
i have configured outputs.conf (ip:9997) in linux universal forwarder and at splunk instances configured receiver as 9997. but still not working.
i have stop firewall with sudo ufw disable and tried. but still not working
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Have you validated that your Splunk indexer is listening on port 9997 and that your UF is configured in the outputs.conf to send to your indexer over port 9997? I would also validate that you have port 9997 open in your firewall as well. You can validate this with telnet.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
i have configured outputs.conf (ip:9997) in linux universal forwarder and at splunk instances configured receiver as 9997. but still not working.
i have stop firewall with sudo ufw disable and tried. but still not working
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
its working fine with heavy forwarder but not with universal forwarder
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Can you telnet over port 9997? Also have you checked the physical firewall to ensure that the ports are open?
Join Us for Splunk University and Get Your Bootcamp Game On!
.conf24 | Learning Tracks for Security, Observability, Platform, and Developers!
Announcing Scheduled Export GA for Dashboard Studio
