https://community.splunk.com/t5/Deployment-Architecture/How-do-I-get-the-nix-app-on-the-indexer-to-include-the-forwarded/m-p/47606#M1433 <P>Is your forwarder &amp; receiver properly working?</P> <P>If not you may check these out first:</P> <UL> <LI><A href="http://www.splunk.com/base/Documentation/4.1.7/admin/AboutForwardingAndReceiving" rel="nofollow">http://www.splunk.com/base/Documentation/4.1.7/admin/AboutForwardingAndReceiving</A></LI> <LI><A href="http://www.splunk.com/base/Documentation/4.1.7/admin/Enableforwardingandreceiving" rel="nofollow">http://www.splunk.com/base/Documentation/4.1.7/admin/Enableforwardingandreceiving</A></LI> </UL> Sat, 19 Feb 2011 08:35:50 GMT LCM 2011-02-19T08:35:50Z https://community.splunk.com/t5/Deployment-Architecture/How-do-I-get-the-nix-app-on-the-indexer-to-include-the-forwarded/m-p/47605#M1432 <P>I have the unix machines forwarding *nix recordes. I can use search to view the records.</P> <P>How do get the *nix application on the indexer to include those records. I all I see is the local *nix records.</P> Sat, 19 Feb 2011 07:29:19 GMT https://community.splunk.com/t5/Deployment-Architecture/How-do-I-get-the-nix-app-on-the-indexer-to-include-the-forwarded/m-p/47605#M1432 labrat 2011-02-19T07:29:19Z https://community.splunk.com/t5/Deployment-Architecture/How-do-I-get-the-nix-app-on-the-indexer-to-include-the-forwarded/m-p/47606#M1433 <P>Is your forwarder &amp; receiver properly working?</P> <P>If not you may check these out first:</P> <UL> <LI><A href="http://www.splunk.com/base/Documentation/4.1.7/admin/AboutForwardingAndReceiving" rel="nofollow">http://www.splunk.com/base/Documentation/4.1.7/admin/AboutForwardingAndReceiving</A></LI> <LI><A href="http://www.splunk.com/base/Documentation/4.1.7/admin/Enableforwardingandreceiving" rel="nofollow">http://www.splunk.com/base/Documentation/4.1.7/admin/Enableforwardingandreceiving</A></LI> </UL> Sat, 19 Feb 2011 08:35:50 GMT https://community.splunk.com/t5/Deployment-Architecture/How-do-I-get-the-nix-app-on-the-indexer-to-include-the-forwarded/m-p/47606#M1433 LCM 2011-02-19T08:35:50Z https://community.splunk.com/t5/Deployment-Architecture/How-do-I-get-the-nix-app-on-the-indexer-to-include-the-forwarded/m-p/47607#M1434 <P>I did spend some time looking through this documentation. I may have misunderstood something.</P> <P>I am using the lightweight forwarder, is that OK.</P> Sat, 19 Feb 2011 08:42:30 GMT https://community.splunk.com/t5/Deployment-Architecture/How-do-I-get-the-nix-app-on-the-indexer-to-include-the-forwarded/m-p/47607#M1434 labrat 2011-02-19T08:42:30Z https://community.splunk.com/t5/Deployment-Architecture/How-do-I-get-the-nix-app-on-the-indexer-to-include-the-forwarded/m-p/47608#M1435 <P>Yes, it works with a lightweight forwarder!</P> <P>Check the connection on forwarder:</P> <PRE><CODE>* grep "Connected to /opt/splunk/var/log/splunk/splunkd.log </CODE></PRE> <P>Check the connection on the indexer:</P> <PRE><CODE>* grep "Connection accepted from /opt/splunk/var/log/splunk/splunkd.log </CODE></PRE> Mon, 21 Feb 2011 22:21:10 GMT https://community.splunk.com/t5/Deployment-Architecture/How-do-I-get-the-nix-app-on-the-indexer-to-include-the-forwarded/m-p/47608#M1435 LCM 2011-02-21T22:21:10Z