topic Re: Getting isHttpOutConfigured=NOT_CONFIGURED in Splunkd logs in Getting Data In

Getting isHttpOutConfigured=NOT_CONFIGURED in Splunkd logs

prajwal_94 — Mon, 17 Jun 2024 09:34:34 GMT

I had defined the complete path in inputs.conf and restarted the Splunkforwarder but got error in Splunkd logs.

Kindly refer the attachment.

Re: Getting isHttpOutConfigured=NOT_CONFIGURED in Splunkd logs

richgalloway — Mon, 17 Jun 2024 18:43:20 GMT

The message appears because httpout is not configured. The outputs.conf file shown defines tcpout, not httpout. Since the [httpout] stanza is optional, these INFO messages can be ignored.

Re: Getting isHttpOutConfigured=NOT_CONFIGURED in Splunkd logs

prajwal_94 — Tue, 18 Jun 2024 11:56:23 GMT

Hi @richgalloway ,Thanks for the reply but may I know what needs to be done here so that data is forwarded to indexer and then search results are obtained.

Re: Getting isHttpOutConfigured=NOT_CONFIGURED in Splunkd logs

richgalloway — Tue, 18 Jun 2024 15:52:36 GMT

You've already done what is necessary. A TCP connection to the indexer(s) is all you need.

Forwarders are a one-way device. They send data to indexers, but do not obtain search results. Searches and their results go through a search head.

Re: Getting isHttpOutConfigured=NOT_CONFIGURED in Splunkd logs

prajwal_94 — Wed, 19 Jun 2024 17:01:56 GMT

Hi @richgalloway ,even TCP connection is setup to the indexer and its port. No firewall blocking as well but still no events being returned on search.