https://community.splunk.com/t5/Deployment-Architecture/light-forwarder-question/m-p/66363#M2317 <P>Where are you seeing this error? What port did you configure the forwarder to send its events to?</P> Sat, 02 Jun 2012 19:08:47 GMT Ayn 2012-06-02T19:08:47Z https://community.splunk.com/t5/Deployment-Architecture/light-forwarder-question/m-p/66362#M2316 <P>Hi,</P> <P>The local Splunk folks recommended we switch from a universal forwarder to a light-forwarder in our dev env. I installed the full splunk image, and enabled light-forwarding, but now I'm seeing "Connection to XX.XX.XXX.XX:8089 closed. Read error. Connection reset by peer" messages. I enabled light-fowarding, and added the forwarder destination. Is this port right? Not sure what I missed here...</P> Fri, 01 Jun 2012 23:45:51 GMT https://community.splunk.com/t5/Deployment-Architecture/light-forwarder-question/m-p/66362#M2316 a212830 2012-06-01T23:45:51Z https://community.splunk.com/t5/Deployment-Architecture/light-forwarder-question/m-p/66363#M2317 <P>Where are you seeing this error? What port did you configure the forwarder to send its events to?</P> Sat, 02 Jun 2012 19:08:47 GMT https://community.splunk.com/t5/Deployment-Architecture/light-forwarder-question/m-p/66363#M2317 Ayn 2012-06-02T19:08:47Z https://community.splunk.com/t5/Deployment-Architecture/light-forwarder-question/m-p/66364#M2318 <P>I am seeing it in the splunkd.log on the agent server. I used port 8089 as the forwarder port - I don't see any doc that states what port to use. </P> Sat, 02 Jun 2012 19:29:22 GMT https://community.splunk.com/t5/Deployment-Architecture/light-forwarder-question/m-p/66364#M2318 a212830 2012-06-02T19:29:22Z https://community.splunk.com/t5/Deployment-Architecture/light-forwarder-question/m-p/66365#M2319 <P>Port 8089 is used for intra-splunk communication (license info, deployment traffic, etc), not for sending and receiving logs. You should configure the forwarder to send its logs to a port that has been setup for receiving forwarded logs on the indexer - which port number it has depends on what port the indexer has been configured to use, but port 9997 is commonly used for this. </P> <P>Some docs on the subject:<BR /> <A href="http://docs.splunk.com/Documentation/Splunk/latest/Deploy/Deploymentoverview">http://docs.splunk.com/Documentation/Splunk/latest/Deploy/Deploymentoverview</A><BR /> <A href="http://docs.splunk.com/Documentation/Splunk/4.3.2/Deploy/DeployaWindowsdfmanually">http://docs.splunk.com/Documentation/Splunk/4.3.2/Deploy/DeployaWindowsdfmanually</A></P> Sat, 02 Jun 2012 19:38:36 GMT https://community.splunk.com/t5/Deployment-Architecture/light-forwarder-question/m-p/66365#M2319 Ayn 2012-06-02T19:38:36Z https://community.splunk.com/t5/Deployment-Architecture/light-forwarder-question/m-p/66366#M2320 <P>Ah, gatcha. Wasn't sure if there was some sort of "funnel", where I read from different ports and sent them over a different one. So, if I read 3 different ports, I should have 3 corresponding outputs to the indexer?</P> Sat, 02 Jun 2012 20:20:25 GMT https://community.splunk.com/t5/Deployment-Architecture/light-forwarder-question/m-p/66366#M2320 a212830 2012-06-02T20:20:25Z https://community.splunk.com/t5/Deployment-Architecture/light-forwarder-question/m-p/66367#M2321 <P>No, you only need one output per indexer from the forwarder, regardless of how many sources (files, ports, scripts, ...) the forwarder has.</P> Sat, 02 Jun 2012 21:24:20 GMT https://community.splunk.com/t5/Deployment-Architecture/light-forwarder-question/m-p/66367#M2321 Ayn 2012-06-02T21:24:20Z https://community.splunk.com/t5/Deployment-Architecture/light-forwarder-question/m-p/66368#M2322 <P>Duh. OK. Thanks!</P> Sat, 02 Jun 2012 23:29:47 GMT https://community.splunk.com/t5/Deployment-Architecture/light-forwarder-question/m-p/66368#M2322 a212830 2012-06-02T23:29:47Z