topic Re: How to configure UF to send data to splunk stand alone instance? in Splunk Enterprise

How to configure UF to send data to splunk stand alone instance?

Ashwini008 — Fri, 23 Oct 2020 07:43:49 GMT

I am trying to send logs through UF to my Stand alone instance but data is not getting forwarded.

I have UF installed in one of my test server and added inputs.conf,outputs.conf and set deployment.conf then restarted my splunk service in test server.In my stand alone instance i have created index.

Outputs.conf (opt/app/splunk/splunk/etc/system/local)

[tcpout]

defaultGroup=group1

[tcpout:group1]

server=mysplunkhost.com:9997

inputs.conf (opt/app/splunk/splunk/etc/system/local)

[monitor:///folder/upload/cen*]

index = test_index

sourcetype = cenere

disabled=false

Should there be any configuration setup in my standalone instance?I dont see serverclass defined in my standalone instance .

Any other configurations needs to be added?

Thank you

Re: How to configure UF to send data to splunk stand alone instance?

richgalloway — Fri, 23 Oct 2020 12:52:37 GMT

Did you enable receiving on the standalone instance?

Re: How to configure UF to send data to splunk stand alone instance?

inventsekar — Fri, 23 Oct 2020 13:10:18 GMT

Hi @Ashwini008 from UF to indexer, the ping and "telnet <receiving-port>" works fine ah?

as @richgalloway said, on splunk indexer, did you enable receiving? at what port?

any firewall rules between UF to indexer?

are the other UF's sending logs to indexer fine?

Re: How to configure UF to send data to splunk stand alone instance?

alemarzu — Sat, 24 Oct 2020 01:04:55 GMT

Hi @Ashwini008

Make sure your forwarder can also resolve your standalone FQDN, if not replace it for the IP on your outputs.conf.

Theres also something weird about config files locations. Can you please verify if thats correct? Usually, the UF path for these config files would be something like /opt/splunkforwarder/... but you have opt/app/splunk/splunk/etc/system/local

Re: How to configure UF to send data to splunk stand alone instance?

isoutamo — Sat, 24 Oct 2020 10:59:07 GMT

If/when you want to use deployment server then you should create app for these configurations instead of put them to system/local. And even if not, use still an app for easier management.

You could test with

curl -vk telnet://your.spl.IDX.name:9997

that tells if it can

- resolve your server name

- connect to it

And as @alemarzu said usually path contains splunkforwarder if you are using UF. If it contains splunk then this is normally HF.

Before your UF can send to IDX you must enable it’s listening/receiving, it default is not to receive.

r. Ismo