https://community.splunk.com/t5/Getting-Data-In/Can-t-Point-Universal-Forwarder-to-an-Indexer-from-Deployment/m-p/61462#M12247 <P>I figured it out, but I wanted to post my answer here in case anyone else has the same problem!</P> <P>If you look in SplunkUniversalForwarder/etc/system/local, there's a file called server.conf that defines your hostname. In my case, the whitelist provided did not match this hostname; I had provided the fully-qualified domain name, but server.conf did not. Once I fixed this problem, everything worked fine.</P> Mon, 17 Sep 2012 17:57:38 GMT BenjaminWyatt 2012-09-17T17:57:38Z https://community.splunk.com/t5/Getting-Data-In/Can-t-Point-Universal-Forwarder-to-an-Indexer-from-Deployment/m-p/61461#M12246 <P>Hi everyone,<BR /> I have several forwarders in my environment that aren't currently sending any data to indexers. I've been trying to link them up to indexer by pushing an app to them from their deployment server (which they were linked up to in the installation). I've been working with a test case at this point, but I've been having trouble pushing the app to the Splunk Universal Forwarder.</P> <P>Here's the process I followed: </P> <OL> <LI><P>Create a new app on the deployment server in /opt/splunk/etc/deployment-apps. Create an outputs.conf file in /opt/splunk/etc/deployment-apps/<DEPLOYMENT_APP_NAME>/local with the following syntax: </DEPLOYMENT_APP_NAME></P> <P>[tcpout]<BR /><BR /> indexAndForward=false<BR /><BR /> defaultGroup=my_LB_indexers</P> <P>[tcpout:my_LB_indexers]<BR /><BR /> disabled=false<BR /><BR /> server=indexer_name:port#</P></LI> <LI><P>Edit serverclass.conf in ~etc/system/local to apply the app to the desired forwarders by adding the following stanzas: </P> <P>[serverClass:my_test_serverclass_name]<BR /><BR /> filterType = whitelist<BR /><BR /> repositoryLocation = /opt/splunk/etc/deployment-apps<BR /><BR /> restartSplunkd = true<BR /><BR /> whitelist.0 = hostname_pattern</P> <P>[serverClass:my_test_serverclass_name:app:deployment_app_name]</P></LI> <LI><P>Restart the deployment server to push the config changes. I use the command: splunk reload deploy-server</P></LI> </OL> <P>I can see the new serverclass and my desired hosts on the deployment server. However, it seems that the application has never been pushed to my forwarders. I've checked splunkd.log for error messages after the restart, but I haven't seen any error messages pertaining to my app. What am I missing here? Any help is greatly appreciated!</P> Mon, 17 Sep 2012 14:55:37 GMT https://community.splunk.com/t5/Getting-Data-In/Can-t-Point-Universal-Forwarder-to-an-Indexer-from-Deployment/m-p/61461#M12246 BenjaminWyatt 2012-09-17T14:55:37Z https://community.splunk.com/t5/Getting-Data-In/Can-t-Point-Universal-Forwarder-to-an-Indexer-from-Deployment/m-p/61462#M12247 <P>I figured it out, but I wanted to post my answer here in case anyone else has the same problem!</P> <P>If you look in SplunkUniversalForwarder/etc/system/local, there's a file called server.conf that defines your hostname. In my case, the whitelist provided did not match this hostname; I had provided the fully-qualified domain name, but server.conf did not. Once I fixed this problem, everything worked fine.</P> Mon, 17 Sep 2012 17:57:38 GMT https://community.splunk.com/t5/Getting-Data-In/Can-t-Point-Universal-Forwarder-to-an-Indexer-from-Deployment/m-p/61462#M12247 BenjaminWyatt 2012-09-17T17:57:38Z