topic Re: Splunk Forwarder Unable to Connect to Target Folder in Getting Data In

Splunk Forwarder Unable to Connect to Target Folder

Randall2022 — Tue, 10 May 2022 08:40:35 GMT

Hi,

I am currently facing an issue where my Splunk Universal Forwarder is able to establish connection with the Splunk Server but it is unable to port over the data from the target folder of interest. Is there a way to trouble shoot this?

A diagnostic test of index="_internal" would show that Splunk is streaming in system logs from my PC, thus proving that a link has already been established with the Splunk Server. However, trying to query using index="ForwarderText_index" (my target index for the targeted files), would yield nothing.

Splunk Universal Forwarder Installation Configuration Details:

Server: MyServerName

Port/Management Port: 8089 (default)

Target Folder: C:\Users\MyUserName\Documents\MyProject\logs\Splunk_Monitoring_Folder

_______________________________________

inputs.conf

location: C:\Program Files\SplunkUniversalForwarder\etc\system\local

File contents:

[monitor://C:\Users\cftfda01\Documents\MyProject\logs\Splunk_Monitoring_Folder\SubFolder01]

disabled = false

index = ForwarderText_index

host = MyComputerID

_______________________________________

outputs.conf

location: C:\Program Files\SplunkUniversalForwarder\etc\system\local

[tcpout]

defaultGroup = default-autolb-group

[tcpout:default-autolb-group]

server =MyServerName:9997

[tcpout-server://MyServerName:9997]

Re: Splunk Forwarder Unable to Connect to Target Folder

gcusello — Tue, 10 May 2022 08:47:55 GMT

Hi @Randall2022,

the first check is:

index=_internal host=your_host

if you have results the connection is ok, otherwise you have to investigate the connection, e.g. using telnet

telnet ip_server_splunk 9997

If you have data in _internal, the problem in in the data input.

could you try to modify the inputs.conf and restart the Forwarder?

[monitor://C:\Users\cftfda01\Documents\MyProject\logs\Splunk_Monitoring_Folder\SubFolder01\*.*] disabled = false index = ForwarderText_index host = MyComputerID

Ciao.

Giuseppe

Re: Splunk Forwarder Unable to Connect to Target Folder

SinghK — Tue, 10 May 2022 09:03:49 GMT

did you try searching it with time set to all time instead of a specific time filter.

Re: Splunk Forwarder Unable to Connect to Target Folder

Randall2022 — Tue, 10 May 2022 09:04:54 GMT

Tried that to no avail

Re: Splunk Forwarder Unable to Connect to Target Folder

SinghK — Tue, 10 May 2022 09:12:11 GMT

did you check splunkd.logs for the forwarder ?

any errors?

and @gcusello informed about modifying the input you created, have you done it ?

Re: Splunk Forwarder Unable to Connect to Target Folder

Randall2022 — Wed, 11 May 2022 02:04:31 GMT

There's data coming in to index="_internal", but nothing in for the target index. I've also created the target index separately in the Splunk Enterprise settings already. Adding a wildcard variable to the inputs.conf file like what you suggested also did not work.

Re: Splunk Forwarder Unable to Connect to Target Folder

Randall2022 — Wed, 11 May 2022 02:06:09 GMT

How do I go about checking the splunkd.logs for the forwarder?

I've tried @gcusello's proposal to change the inputs.conf file, but that didn't work too.

Re: Splunk Forwarder Unable to Connect to Target Folder

SinghK — Thu, 12 May 2022 10:28:38 GMT

Logs are in /opt/splunkforwarder/var/log/splunk directory

or if you are getting internal logs then

index=_internal host=<your host> sourcetype= splunkd should give you the logs

check if you see any errors