topic Re: Splunk forwarder, instance, Sending log from my Linux installed on Hyper-v in Deployment Architecture

Splunk forwarder, instance, Sending log from my Linux installed on Hyper-v

ibztek — Sat, 26 Aug 2023 23:07:50 GMT

I'm trying to send log from my Linux installed on Hyper-v windows into my Splunk instance and it data doesn't seem to reach it's destination. I have entered the port number in my Splunk instance - Receive data - configure receiving and entered my port number. i edited my input.conf file and why can't I see my log in Splunk???

Re: Splunk forwarder, instance, Sending log from my Linux installed on Hyper-v

isoutamo — Sat, 26 Aug 2023 23:10:54 GMT

can you see that your UF has sent its internal logs to server?

r. Ismo

Re: Splunk forwarder, instance, Sending log from my Linux installed on Hyper-v

ibztek — Sat, 26 Aug 2023 23:19:11 GMT

how can i do that, can you be a bit specific ? thank you

Re: Splunk forwarder, instance, Sending log from my Linux installed on Hyper-v

ibztek — Sat, 26 Aug 2023 23:20:37 GMT

i don't see my host in the splunk at all.

Re: Splunk forwarder, instance, Sending log from my Linux installed on Hyper-v

isoutamo — Sat, 26 Aug 2023 23:22:57 GMT

You could make a query on sh like

index=_internal host=<your UF node name + *> earliest=1

this should show some entries, if your UF has connection to server.

Re: Splunk forwarder, instance, Sending log from my Linux installed on Hyper-v

ibztek — Sat, 26 Aug 2023 23:40:27 GMT

iam trying to find my uf node name..im very new to splunk

Re: Splunk forwarder, instance, Sending log from my Linux installed on Hyper-v

ibztek — Sat, 26 Aug 2023 23:52:04 GMT

index=_internal host=<your UF node name + *> earliest=1

doesn't seem to reply anything.

Re: Splunk forwarder, instance, Sending log from my Linux installed on Hyper-v

isoutamo — Sun, 27 Aug 2023 09:33:05 GMT

You could find your UF’s name from its $SPLUNK_HOME/var/log/splunk/splunkd.log. That log file contains also information if it can send it’s own logs to splunk server.

I assume that you have outputs.conf on place and it has defined your splunk server as a target?

Re: Splunk forwarder, instance, Sending log from my Linux installed on Hyper-v

PickleRick — Sun, 27 Aug 2023 18:52:57 GMT

Check the contents of /opt/splunkforwarder/var/log/splunk/splunkd.log on your forwarder (especially the last entries in that log). That should show you whether it tried to connect to the indexer and if it did, why it failed.

Re: Splunk forwarder, instance, Sending log from my Linux installed on Hyper-v

ibztek — Mon, 28 Aug 2023 10:25:43 GMT

write now i am getting error when i try to ping splunkdeploy.customerscallnow.com: name or service not known..i seem to follow a prety nice instruction but i am not yet able to connect

Re: Splunk forwarder, instance, Sending log from my Linux installed on Hyper-v

ibztek — Mon, 28 Aug 2023 10:55:45 GMT

it is tryiing to connect but it failes with name or service uknown

Re: Splunk forwarder, instance, Sending log from my Linux installed on Hyper-v

PickleRick — Mon, 28 Aug 2023 11:03:55 GMT

So either your outputs.conf in the forwarder point to a wrong server or you have DNS problems in your VM.

Re: Splunk forwarder, instance, Sending log from my Linux installed on Hyper-v

isoutamo — Mon, 28 Aug 2023 16:34:44 GMT

This error told that your DNS service cannot found it for that name. You should fix it first and then check if UF works after that.