https://community.splunk.com/t5/Deployment-Architecture/Unable-to-see-the-forwarded-data-in-the-splunk-receiver-when/m-p/187748#M7006 <P>Hello,</P> <P>yes that means that the connection between the forwarder and reciever is established! You can also test if data is send to the reciever if you check your tcp connections with netstat comand after running your java program. Do you still not see any input when you search for anything in the web frontend? <BR /> Besides you can set the sourcetype in the forwarder input.</P> Wed, 04 Jun 2014 13:42:32 GMT C_Sparn 2014-06-04T13:42:32Z https://community.splunk.com/t5/Deployment-Architecture/Unable-to-see-the-forwarded-data-in-the-splunk-receiver-when/m-p/187742#M7000 <P>I am trying to use windows universal forwarder to forward data which is coming in my localhost 9998 port . A java program is writing data to my localhost 9998 port, this data i want my universal forwarder to listen to and forward it to a splunk receiver's 9997 port.</P> <P>For this config files on universal forwarder side:-</P> <P>inputs.conf content-<BR /> [tcp://:9998]<BR /> connection_host=ip </P> <P>outputs.conf content-<BR /> [tcpout]<BR /> disabled= false<BR /> defaultGroup = default-autolb-group<BR /> useACK=true</P> <P>[tcpout:default-autolb-group]<BR /> disabled= false<BR /> server = 10.74.163.105:9997</P> <P>[tcpout-server://10.74.163.105:9997]<BR /> disabled= false</P> <P>And the content of inputs.conf file in the splunk receiver is:-</P> <P>inputs.conf content-</P> <P>[default]<BR /> host = IN-AIR-BIMAP110</P> <P>[script://$SPLUNK_HOME\bin\scripts\splunk-wmi.path]<BR /> disabled = 0</P> <P>[splunktcp://9997]<BR /> disabled = 0<BR /> index= test_tcp2<BR /> queue= indexQueue<BR /> sourcetype=csv</P> <P>Setting all these configs when i search the data no data is shown by the splunk receiver.<BR /> Need help whether the config file settings are fine.</P> Wed, 04 Jun 2014 07:53:25 GMT https://community.splunk.com/t5/Deployment-Architecture/Unable-to-see-the-forwarded-data-in-the-splunk-receiver-when/m-p/187742#M7000 rahsaha 2014-06-04T07:53:25Z https://community.splunk.com/t5/Deployment-Architecture/Unable-to-see-the-forwarded-data-in-the-splunk-receiver-when/m-p/187743#M7001 <P>Hello,</P> <P>try to set your inputs.conf of the forwarder with [tcp://localhost:9998] and disabled= false under connection_host.<BR /> Then test the connection between the forwarder and the reciever with this line in cmd of windows:</P> <P>path-to-splunk-folder\bin\splunk list forward-server</P> <P>If the connection is established this line shows the connected recievers. <BR /> Greetings</P> Wed, 04 Jun 2014 10:40:03 GMT https://community.splunk.com/t5/Deployment-Architecture/Unable-to-see-the-forwarded-data-in-the-splunk-receiver-when/m-p/187743#M7001 C_Sparn 2014-06-04T10:40:03Z https://community.splunk.com/t5/Deployment-Architecture/Unable-to-see-the-forwarded-data-in-the-splunk-receiver-when/m-p/187744#M7002 <P>How did you search for the data? Looking at your configs, the data is most likely ended up in index=main.</P> <P>The index=test_tcp2 under splunktcp stanza won't override the index specified in your forwarder.</P> Wed, 04 Jun 2014 12:29:48 GMT https://community.splunk.com/t5/Deployment-Architecture/Unable-to-see-the-forwarded-data-in-the-splunk-receiver-when/m-p/187744#M7002 kheli 2014-06-04T12:29:48Z https://community.splunk.com/t5/Deployment-Architecture/Unable-to-see-the-forwarded-data-in-the-splunk-receiver-when/m-p/187745#M7003 <P>Hi C_Sparn,<BR /> I am getting this output:-Active Forwards: 10.74.163.105:9997 Configured but Inactive forwards:None.Does this indicate that the forwarder is forwarding?</P> Wed, 04 Jun 2014 13:14:19 GMT https://community.splunk.com/t5/Deployment-Architecture/Unable-to-see-the-forwarded-data-in-the-splunk-receiver-when/m-p/187745#M7003 rahsaha 2014-06-04T13:14:19Z https://community.splunk.com/t5/Deployment-Architecture/Unable-to-see-the-forwarded-data-in-the-splunk-receiver-when/m-p/187746#M7004 <P>hi kheli.I searched in the main index nothing there.The root cause which is my guess is that is when i point my universal forwarder to listen to 9998 port on my localhost the java program which tries to write data to my localhost 9998 port is unable to write data throwing this exception(Exception while opening the Port Address already in use: JVM_Bind). That means the java program should be able to write on 9998 at the same time the splunk universal forwarder should be able to listen to that data.Do u have any idea on this?</P> Wed, 04 Jun 2014 13:30:14 GMT https://community.splunk.com/t5/Deployment-Architecture/Unable-to-see-the-forwarded-data-in-the-splunk-receiver-when/m-p/187746#M7004 rahsaha 2014-06-04T13:30:14Z https://community.splunk.com/t5/Deployment-Architecture/Unable-to-see-the-forwarded-data-in-the-splunk-receiver-when/m-p/187747#M7005 <P>hi C_Sparn.I searched in the main index nothing there.The root cause which is my guess is that is when i point my universal forwarder to listen to 9998 port on my localhost the java program which tries to write data to my localhost 9998 port is unable to write data throwing this exception(Exception while opening the Port Address already in use: JVM_Bind). That means the java program should be able to write on 9998 at the same time the splunk universal forwarder should be able to listen to that data.Do u have any idea on this?</P> Mon, 28 Sep 2020 16:47:17 GMT https://community.splunk.com/t5/Deployment-Architecture/Unable-to-see-the-forwarded-data-in-the-splunk-receiver-when/m-p/187747#M7005 rahsaha 2020-09-28T16:47:17Z https://community.splunk.com/t5/Deployment-Architecture/Unable-to-see-the-forwarded-data-in-the-splunk-receiver-when/m-p/187748#M7006 <P>Hello,</P> <P>yes that means that the connection between the forwarder and reciever is established! You can also test if data is send to the reciever if you check your tcp connections with netstat comand after running your java program. Do you still not see any input when you search for anything in the web frontend? <BR /> Besides you can set the sourcetype in the forwarder input.</P> Wed, 04 Jun 2014 13:42:32 GMT https://community.splunk.com/t5/Deployment-Architecture/Unable-to-see-the-forwarded-data-in-the-splunk-receiver-when/m-p/187748#M7006 C_Sparn 2014-06-04T13:42:32Z https://community.splunk.com/t5/Deployment-Architecture/Unable-to-see-the-forwarded-data-in-the-splunk-receiver-when/m-p/187749#M7007 <P>Hi C_Sparn.i ran the command netstat.Output it is giving is as follows:- TCP 10.76.17.213:65500(local adress 10.74.163.105:9997(foreign address) ESTABLISHED. Does this mean the forwarder is sending data to my receiver?</P> Wed, 04 Jun 2014 14:01:12 GMT https://community.splunk.com/t5/Deployment-Architecture/Unable-to-see-the-forwarded-data-in-the-splunk-receiver-when/m-p/187749#M7007 rahsaha 2014-06-04T14:01:12Z https://community.splunk.com/t5/Deployment-Architecture/Unable-to-see-the-forwarded-data-in-the-splunk-receiver-when/m-p/187750#M7008 <P>Hello C_Sparn. May be my forwarding is establishing connection wt the receiver but the thing is to be able to see any result the forwarder should be forwarding some data. I guess in my case the forwarding is forwarding no events. As i said earlier the java program is not able to write anything on 9998 port .So the forwarder has nothing to forward.If u can help me with how to make the java program write at the same port when my forwarder is listening. Waiting for ur reply. Nice to chat wt you.</P> Wed, 04 Jun 2014 14:09:44 GMT https://community.splunk.com/t5/Deployment-Architecture/Unable-to-see-the-forwarded-data-in-the-splunk-receiver-when/m-p/187750#M7008 rahsaha 2014-06-04T14:09:44Z