topic Re: Forwarders not forwarding in Deployment Architecture

Forwarders not forwarding

vdevarayan — Mon, 28 Sep 2020 19:02:55 GMT

I have a splunk index running at host1:9997
(used this command to enable it /opt/splunk/bin/splunk enable listen 9997)

I installed forwarder using splunkforwarder-6.2.2-255606-linux-2.6-x86_64.rpm

I added inputs.conf and its content is like this:

[root@/opt/splunkforwarder/etc/system/local]# cat inputs.conf
[default]
host = host2

[monitor:///tmp/test-splunk.csv]
sourcetype = test_result
disabled = 0
index = test_result

[root@/opt/splunkforwarder/etc/system/local]# /opt/splunkforwarder/bin/splunk list forward-server
Active forwards:
None
Configured but inactive forwards:
host1:9997

[root@/opt/splunkforwarder/etc/system/local]# ls -l /tmp/test-splunk.csv
-rw-r--r-- 1 root root 3704 Feb 25 07:22 /tmp/holodeck-splunk.csv

I restarted the forwarder but still active forwards says none.

Though the files are owned by root, perms seems correct.

Am I missing any steps?

I followed the steps from:

http://answers.splunk.com/answers/50082/how-do-i-configure-a-splunk-forwarder-on-linux.html

Re: Forwarders not forwarding

satishsdange — Wed, 25 Feb 2015 07:55:15 GMT

Outputs.conf seems to be missing.

[tcpout]
autoLB = true
defaultGroup = default-autolb-group
[tcpout:default-autolb-group]
disabled = false
server = 192.168.10.3:9997,192.168.10.4:9997,192.168.10.8:9997

Also check if you have enabled receiving on indexer with port 9997.

If problem still persist, then check below & share result-

tail -100f splunkd.log | grep TcpOutputProc

Re: Forwarders not forwarding

vdevarayan — Wed, 25 Feb 2015 08:26:13 GMT

I added the outputs.conf as mentioned above. Changed the server to have the index host listening on 9997
Here is my outputs.conf:
[tcpout]
autoLB = true
defaultGroup = default-autolb-group

[tcpout:default-autolb-group]
disabled = false
server = host1:9997

[tcpout-server://host1:9997]

Here is the output
tail -100f /opt/splunkforwarder/var/log/splunk/splunkd.log | grep TcpOutputProc

02-25-2015 08:16:11.051 +0000 INFO TcpOutputProc - Initializing with fwdtype=lwf
02-25-2015 08:16:11.057 +0000 INFO TcpOutputProc - found Whitelist forwardedindex.0.whitelist , RE : forwardedindex.0.whitelist
02-25-2015 08:16:11.057 +0000 INFO TcpOutputProc - found Blacklist forwardedindex.1.blacklist , RE : forwardedindex.1.blacklist
02-25-2015 08:16:11.057 +0000 INFO TcpOutputProc - found Whitelist forwardedindex.2.whitelist , RE : forwardedindex.2.whitelist
02-25-2015 08:16:11.057 +0000 INFO TcpOutputProc - Initializing connection for non-ssl forwarding to host1:9997
02-25-2015 08:16:11.057 +0000 INFO TcpOutputProc - tcpout group default-autolb-group using Auto load balanced forwarding
02-25-2015 08:16:11.057 +0000 INFO TcpOutputProc - Group default-autolb-group initialized with maxQueueSize=512000 in bytes.
02-25-2015 08:16:11.152 +0000 INFO TcpOutputProc - Connected to idx=10.90.108.107:9997

How to verify this step:
check if you have enabled receiving on indexer with port 9997

thanks

Re: Forwarders not forwarding

satishsdange — Wed, 25 Feb 2015 08:43:13 GMT

I see your UF is connected to Indexer. Are you still facing problem?

Here is command to enable receiving on indexer
./splunk enable listen 9997

Re: Forwarders not forwarding

vdevarayan — Wed, 25 Feb 2015 23:05:26 GMT

Problem got solved when I added the index on the indexer.
I followed the instructions given at
http://answers.splunk.com/answers/50082/how-do-i-configure-a-splunk-forwarder-on-linux.html

It did not mention about adding the index name to the indexer. I missed this step.
Now, its all good.