topic Re: I can not see and add forwarder in Splunk enterprise. in Getting Data In

I can not see and add forwarder in Splunk enterprise.

Dyrock — Fri, 30 Aug 2024 00:00:49 GMT

Hello,

This is my first experience with Splunk as I am setting up a lab.

in VirtualBox I have:

VM1: Act as server: Ubuntu desktop 24.04 LTS - IP: 192.168.0.33 - Installed Splunk Enterprise - Added port 997 under configure receiving - Added Index, named it Sysmonlog.

VM2: Act as client: Windows 10 IP: 192.168.0.34 - Installed Sysmon - installed Splunk Forwarder - set the developer ip:192.168.0.34 port 8089 - set indexer 192.168.0.33 port 9997.

ping result is successful form both VMs

When I am about to add the forwarder in my indexer nothing shows up. how should I troubleshoot this to be able to add the forwarder?

Re: I can not see and add forwarder in Splunk enterprise.

gcusello — Fri, 30 Aug 2024 06:31:20 GMT

Hi @Dyrock ,

as you can see in https://www.splunk.com/en_us/resources/videos/getting-data-in-with-forwarders.html and read at https://docs.splunk.com/Documentation/Splunk/9.3.0/Data/Forwarddata and https://docs.splunk.com/Documentation/SplunkCloud/9.2.2403/Forwarding/Aboutforwardingandreceivingdata

You have to:

configure the Indexer to receive logs from UFs (I suppose that 997 is a mistyping because the default port is 9997);
configure the outputs.conf on your UF to send data to the indexers on the same port.
configure the inputs on the UF.

At this point you will see your logs in the Indexer.

Ciao.

Giuseppe