Hi I cannot get the universal forwarder to move to active mode.
I get the following error in splunkd logs. Can you help me sort this out.
05-08-2014 11:49:28.432 -C- Connection to host=10.1.1.xxx :9997 failed
05-08-2014 11:49:58.257 -0400 WARN TcpOutputFd - Connect to 10.1.1.xxx:9997 fa iled. Connection refused
05-08-2014 11:49:58.257 -0400 ERROR TcpOutputFd - Connection to host=10.1.1.146 :9997 failed
05-08-2014 11:50:28.268 -0400 WARN TcpOutputFd - Connect to 10.1.1.xxx:9997 fa iled. Connection refused
05-08-2014 11:50:28.268 -0400 ERROR TcpOutputFd - Connection to host=10.1.1.xxx :9997 failed
05-08-2014 11:50:58.261 -0400 WARN TcpOutputFd - Connect to 10.1.1.xxx:9997 fa iled. Connection refused
05-08-2014 11:50:58.261 -0400 ERROR TcpOutputFd - Connection to host=10.1.1.xxx :9997 failed
[root@d1asepric577 bin]# tail 200 /opt/splunkforwarder/var/log/splunk/splunkd.log
... View more