topic Universal Forwarder- Am I misunderstanding the UF? in Getting Data In

Universal Forwarder- Am I misunderstanding the UF?

socks — Fri, 07 Oct 2022 17:22:18 GMT

Good Morning all ,

I have a standalone splunk installation , there is no syslog data being transmitted and Im really not getting any data collected from the universal forwarded it is phoning home however i dont see any data from the linux server that it is installed on. I dont see any log modifications or anything . am i mis understanding the UF

Re: Universal Forwarder .. am i wrong ?

gcusello — Fri, 07 Oct 2022 17:26:46 GMT

Hi @socks,

let me better understand your architecture:

you have a stand alone Splunk on a linux server,
then you have a Universal Forwarder on another machine (not on the same) connected with the Splunk Server,
you don't see any data from the Universal Forwarder in the Splunk Server,

is it correct?

have you seen the documentation about getting data in from forwarders at https://docs.splunk.com/Documentation/Splunk/latest/Data/Usingforwardingagents ?

or https://community.splunk.com/t5/All-Apps-and-Add-ons/How-do-I-configure-a-Splunk-Forwarder-on-Linux/m-p/72078

Did you configured receinving in the Splunk Server [Settings -- Forwarding and Receiving -- Receiving]?

Did you configured your Universal Forwarder to send data to Splunk modifyng outputs.conf ?

https://docs.splunk.com/Documentation/Forwarder/9.0.1/Forwarder/Configuretheuniversalforwarder

Did you configured inputs?

Ciao.

Giuseppe

Re: Universal Forwarder .. am i wrong ?

isoutamo — Fri, 07 Oct 2022 20:24:24 GMT

here is instructions how to install UF and enable receiving on indexer (on all in one node). https://docs.splunk.com/Documentation/Forwarder/9.0.1/Forwarder/Installanixuniversalforwarder

Your issue sounds like you haven’t configured any inputs! Have you any serverclasses and apps on your server side? Have you check that you have any internal logs from that node? Just check from MC or just wit SPL

index=_internal host=<your UF> sourcetype=splunkd earliest=0

If you found any events then it can send events to server. If not then probably you are missing outputs.conf https://docs.splunk.com/Documentation/Splunk/9.0.1/Admin/Outputsconf. Just add this to point your server and then internal events should found on server.

r. Ismo