topic Re: Having trouble getting started in Getting Data In

Having trouble getting started

dc18 — Thu, 11 Apr 2024 18:03:38 GMT

I installed spunk enterprise on a server named s1. I installed a forwarder on server f1.

Both Windows Server 2019.

When I go into Forwarder Management, s1 sees f1, but I can't DO anything with it. There's nothing on the Forwarder Management screen to CONFIGURE.

If I go to Settings | Data Inputs and try to configure "Remote Performance monitoring" (just as a test, just to monitor something), it says it's going to use WMI and that I should use a forwarder instead.

Yes, please. I want to use a forwarder instead. I want to user my new forwarder, but I just don't see how.

Re: Having trouble getting started

richgalloway — Thu, 11 Apr 2024 18:58:08 GMT

The Forwarder Management screen applies only to Deployment Server (DS) instances. A DS is a Splunk instance type that ensures each forwarder has the configuration (apps) it needs. DSs are optional and are unnecessary when you only have a single forwarder.

When you installed the forwarder, did you configure it to forward data to the server? If so, then you should be seeing data from the forwarder. Verify that by searching for

index=_internal host=f1

Make sure that returns results for continuing further.

The next step is telling the forwarder what you want it to forward. By default, it only sends its own logs. Install the Splunk Add-on for Windows (https://splunkbase.splunk.com/app/742) on the forwarder and turn on (set disabled=0) the inputs you desire. Be sure to restart the forwarder after changing inputs.conf settings.

Re: Having trouble getting started

dc18 — Thu, 11 Apr 2024 19:26:14 GMT

I haven't tried this yet but it sounds very helpful. I'm going to try it later this afternoon.

Thank you!

Re: Having trouble getting started

dc18 — Fri, 12 Apr 2024 01:49:34 GMT

It's working. I just added my second forwarder. Thanks again!