Hi
I have setup Indexer and trying to configure Lightweight forwarder.
My input.conf on indexer looks like this: -
[default]
host = abc
[tcp://:9997]
connection_host = dns
[splunktcp://:9997]
enableS2SHeartbeat = true
s2sHeartbeatTimeout = 60
and output.conf on lighweight forwarder looks like this: -
[tcpout]
disabled = false
indexAndForward = 0
defaultGroup=my_indexers
[tcpout:my_indexers]
server=abc:9997
[tcpout-server://abc:9997]
When I run a wireshark I can see data packets going between the two hosts, but when I look into *NIX or search app, I do not see my lightweight forwader server in it. Any clue what I am missing.
Thanks
... View more