topic Re: How to test succesful Universal Forwarder installation? in Getting Data In

How to test succesful Universal Forwarder installation?

mathdewulf — Sun, 02 Jun 2013 19:28:58 GMT

I've installed the universal forwarder on a windows client to forward the data to my central log collecter which is also a Windows installation.
However i'm seeing no events coming from that source.
Don't know where to start troubleshooting first.
Maybe firewall?
I've downloaded the deployment monitor tool also.

Re: How to test succesful Universal Forwarder installation?

jtworzydlo — Mon, 03 Jun 2013 10:45:46 GMT

Could you paste maybe some extracts from config files (inputs/output.conf?) and tell more about your architecture? Is it only forwarder-indexer or do you have a deployment server installed, too?
My good way to test the installation is to configure passing forwarders own splunkd.log to the indexer - if I see the data than I know that the basic functionality works fine.
If you would like to troubleshoot you should also take a look at the splunkd.log in your var/log/splunk directory.

Re: How to test succesful Universal Forwarder installation?

linu1988 — Mon, 03 Jun 2013 15:45:36 GMT

Best way to troubleshoot is to see splunkd.log under splunk Uniforwarder->var->log folder.

And did you configure the receive port in your search head? and modified the outputs.conf for the destination server?

Re: How to test succesful Universal Forwarder installation?

mathdewulf — Mon, 03 Jun 2013 21:05:11 GMT

the output of splunkd.log on uniforwarder :http://oi43.tinypic.com/2yy81tu.jpg

Which outputs.conf I have to modify on receiver?
Is it the one in \etc\apps\SplunkForwarder\default folder?

Re: How to test succesful Universal Forwarder installation?

mathdewulf — Mon, 03 Jun 2013 21:28:19 GMT

It is so far my first forwarder. I'm just getting started with splunk. I've installed the universal forwarder and installed it on the client to forward logs to my server.
I think my server isn't configured to receive logs from other sources? Port 8889 is not running. I've found several input/outputs.conf files so which one exact is relevant?

Re: How to test succesful Universal Forwarder installation?

jtworzydlo — Wed, 05 Jun 2013 07:28:59 GMT

I think you should be looking at the config files at etc/apps/SplunkUniversalForwarder/local folder. If you have an universal forwarder installed, thats where you should put your config. In the inputs.conf you tell the forwarder which files to monitor. In the outputs.conf you should configure where the data should be sent (your destination (indexer)). Also you should also enable receiving the data on the indexer side (add the [splunktcp://:9997] to the $SPLUNK_HOME/etc/system/local/input.conf). You should also create an index for the data.

Re: How to test succesful Universal Forwarder installation?

LiquidTension — Wed, 05 Jun 2013 15:18:56 GMT

You could try to telnet to your deployment server on the configured port. The error you posted to tinypic.com can be an indicator of a firewall blocking the connection.