Why OpenSuse forwarder says "Active forwards 192.168.2.101:9997 but indexer is not receiving"?

[nils1433]

Hello,

So i've configured my own little splunk with an OpenSuse forwarder and a Windows server 2008 as indexer, however, the forwarder says it's forwarding but the indexer isn't receiving anything.
i'll post a picture of the forwarder as well of the indexer.

Anybody any tips?
I've already checked the outputs.conf on the forwarder and disabled the firewall on the indexer.

thanks in advance!

[nils1433]

The forwarder:

The indexer:

[chanfoli]

It looks like you are confusing forwarder management/deployment server functionality with an indication of forwarding activity. Forwarder management is optional and somewhat more advanced functionality to set up. Have you configured any actual inputs such as file or directory monitors on your forwarder? If not, you will likely not see anything in non-internal indexes since you have not set any inputs up. Let's go back to trsvela's search. If you search your internal index as suggested using your forwarder's hostname or perhaps its IP you might find that it is connected and sending splunk internal logs which get indexed in internal "_*" indexes. Id does look like there might be a problem though, did you perhaps configure some kind of output on your indexer which points to itself?

[trsavela]

Look at the metrics.log on your forwarder, may be some useful info there.

Have you looked at the internal indexes?

 index=_* <forwarder name>

[nils1433]

i have found the logfile but can't read it. i'm not that advanced in splunking.

I've uploaded the logfile Here.

[nils1433]

The IP address of my forwarder is 192.168.2.104. the IP of my indexer is 192.168.2.104

[trsavela]

What is the IP of your indexer? I see this with a quick look at that log, looks like it might be trying to send to itself?

01-14-2015 14:54:18.046 +0100 INFO  StatusMgr - destHost=192.168.2.101, destIp=192.168.2.101, destPort=9997, eventType=connect_fail, publisher=tcpout, sourcePort=8089, statusee=TcpOutputProcessor
01-14-2015 14:54:45.047 +0100 INFO  StatusMgr - destHost=192.168.2.101, destIp=192.168.2.101, destPort=9997, eventType=connect_try, publisher=tcpout, sourcePort=8089, statusee=TcpOutputProcessor