topic Re: Cannot see the Universal forwarder From Splunk Enterprise in Getting Data In

Cannot see the Universal forwarder From Splunk Enterprise

mmatin — Sat, 21 Sep 2024 11:41:52 GMT

Hi,

I have setup 2 VMs in Virtual box, installed the Splunk Enterprise in Windows server 2022, and installed the universal forwarder in windows 10 VM.

I have enabled listening port 9997 in Splunk Enterprise.

While installing UF, I have skipped the deployment server config (let it empty), and entered the IP of Windows server machine in the receiving indexer window.

Then I checked the connection from UF machine to Splunk enterprise by this PS command:

Test-NetConnection -Computername xxx.xxx.x.xxx -port 9997 (Successful)

and from Splunk to Universal forwarder

Test-NetConnection -Computername xxx.xxx.x.xxx (Successful)

So connection is up and running between the 2 devices.

But then in Splunk Enterprise, when I go to Settings > Forwarder Management, I cannot see the windows client.

Same issue in Settings > Add Data > Forward

"There are currently no forwarders configured as deployment clients to this instance"

=== > What am i doing wrong? Did i skip any configuration? Can someone help PLEASE?

Re: Cannot see the Universal forwarder From Splunk Enterprise

PickleRick — Sat, 21 Sep 2024 11:50:54 GMT

You skipped the DS configuration so your UF is _not_ managed by the DS.

You can still configure your UF manually and if you properly pointed it to the indexer, you should see the internal UF's logs in the _internal index but you can't manage the UF until you point it at DS

See https://docs.splunk.com/Documentation/Splunk/latest/Updating/Configuredeploymentclients

Re: Cannot see the Universal forwarder From Splunk Enterprise

mmatin — Sat, 21 Sep 2024 12:01:06 GMT

So do I need another VM setup as the Deployment server? I saw 1 or 2 videos where they said since it's a simple lab setup and only one local forwarder, don't need deployment server config.

Re: Cannot see the Universal forwarder From Splunk Enterprise

PickleRick — Sat, 21 Sep 2024 14:51:06 GMT

No. Your AIO (all-in-one) box which works as SH and indexer can also be a DS. (And it tries to be since you have the forwarder management section enabled in your gui).

Re: Cannot see the Universal forwarder From Splunk Enterprise

mmatin — Sat, 21 Sep 2024 15:00:14 GMT

Tried fresh installation with config for DS as well, didnt work.

Re: Cannot see the Universal forwarder From Splunk Enterprise

mmatin — Sat, 21 Sep 2024 15:02:26 GMT

## Solution found:

- Issue was the windows defender firewall for outbound traffic in the windows 10 (UF machine). Added a new outbound rule for any traffic outgoing via splunkd.exe. And now I can see the device in Forwarder management. 🙂 🙂

Re: Cannot see the Universal forwarder From Splunk Enterprise

isoutamo — Sat, 28 Sep 2024 16:20:22 GMT

This is meaning that you don't need a separate DS server until you have something like 50 UF Deployment Clients.

Usually you should configure own app to manage that DS configuration to UFs. You could use same or separate app for outputs.conf too. If you set those on installation phase then it's hard to change those later as those are configured under ...\etc\system\local which you cannot manage by DS.