Need help to configure indexer and forwarder. This what i have done till now.
But somehow i don't see my forwarder machine under "Search" though log file was mentioned in splunkd logs, not sure what is the problem. Please advise or forward it Splunk support if needed. Thanks
Below is the config changes done so far.
1- on indexer side (cfcmslxdev01.lehman.com), splunk web->manager->forwarding and receiving->receive data: add new. Specify a TCP port (I use 9997). Save and restart
2. On Forwarder (server sgppsr00346)
/apps/splunkforwarder/etc/system/local/inputs.conf
[default]
host = sgppsr00346.intranet.barcapint.com
[monitor:///home/cetprod/TTV2Container/prod_apem/EMOfferingOverlay/log/*.log]
_TCP_ROUTING = GroupName
disabled=false
index=test
/apps/splunkforwarder/etc/system/local/outputs.conf
[tcpout]
defaultGroup = GroupName
[tcpout:GroupName]
server = 10.56.112.114:9997
[tcpout-server://10.56.112.114:9997]
Please advise, Thanks
... View more