Receiving Data on Splunk Server

AmyShah — Thu, 29 Apr 2021 10:11:50 GMT

I am unable to receive data from the forwarder to the server However I have added the server

on server I got

netstat -auntp | grep 9997

tcp 0 0 0.0.0.0:9997 0.0.0.0:* LISTEN
tcp 0 0 myserver:9997 ServerIP:60992 ESTABLISHED

Re: Receiving Data on Splunk Server

gcusello — Thu, 29 Apr 2021 10:27:59 GMT

if you're not receiving data from a Forwarder you have at first to check if you did all the configuration steps:

put Indexer in receiving state [Settings -- Forwarding and Receiving -- Receive Data];
configure Forwarder to send data to that Indexers (https://docs.splunk.com/Documentation/Splunk/latest/Data/Usingforwardingagents), with final restart of the Forwarder;
be sure that the route between them is open (from Forwarder use telnet on the Indexer's 9997 port).

If you did all the above configuration steps, you have to check, if you're receiving logs.

At first check if you're receiving the Splunk internal logs:

index=_internal host=<your_host>

If yes, the problem is that you have to configure inputs (https://docs.splunk.com/Documentation/Splunk/8.1.3/Data/Usingapps) or there's a problem on them.

If not, check again the connection.

Ciao.

Giuseppe