topic Re: Setting up Forwarder and Testing in Getting Data In

Setting up Forwarder and Testing

bherbert — Tue, 24 Jan 2012 18:49:01 GMT

So, I've installed and configured the Splunk forward on my Intranet Server. I'm trying to get the IIS logs from \Windows\Syste32\LogFiles\W3SVC folder. I think that I've configured it properly and have set up the receiving in Manager. Is there anything else on the reciever that I need to set up? I'm not getting any files. How can I test to see if the Intranet Server is even sending the Data?

Re: Setting up Forwarder and Testing

kristian_kolb — Wed, 25 Jan 2012 09:42:33 GMT

Well, you could check the following things;

Is there even a network connection between the two machines?
open up a CMD prompt and type netstat -an | find "ESTABLISHED"
If there is no connection between the machines you may have a firewall issue

Check the splunkd.log for errors (located in /opt/splunk/var/log/splunk on *nix, and in c:\program files\splunk[universalforwarder]\var\log\splunk on win* - unless you've changed install locations).

Check to see if you have configured monitoring correctly. On the forwarding end, type splunk list monitor at the command line. Ensure that you have gotten your (back)slashes in correctly in your monitor stanzas.

If neither of these things will help you to get this going, please supply the outputs.conf from the forwarder, and the inputs.conf from both machines. Depending on how you configured Splunk, these are most likely located in /splunk/etc/apps/search, splunk/etc/apps/launcher or /splunk/etc/system/local. You should have more than on instance of each file on both machines.

Hope this helps,

Kristian

Re: Setting up Forwarder and Testing

bherbert — Wed, 25 Jan 2012 17:59:57 GMT

01-25-2012 12:24:56.633 -0500 WARN DeploymentClient - Unable to send handshake message to deployment server. Error status is: not_connected
01-25-2012 12:25:04.821 -0500 WARN TcpOutputProc - Cooked connection to ip=10.0.50.87:9997 timed out

Looking at the Event Viewer on the Reciever it appears the local firewall is blocking the packets from the forwarder. I assume I'll need to add an exception to the firewall but, what exactly do I need to add? Doesn't appear its using the same port everytime. Suggestions?

Re: Setting up Forwarder and Testing

kristian_kolb — Thu, 26 Jan 2012 16:12:42 GMT

Well, I'm not too familiar with configuring . As for ports, the splunk indexer (receiver) is using the same port all the time, unless you have made an advanced configuration. Most people tend to use port 9997 for log transport. If your indexer is also a Deployment Server, you want to allow traffic from your forwarder to port 8089 (default) on the server.