topic Re: Forwarder is not showing in Splunk in Getting Data In

Forwarder is not showing in Splunk

shivanshuk — Wed, 20 Mar 2013 14:45:26 GMT

Hi Splunk Team,

We have installed splunk tool on a windows server 2003 machine say A and Splunk forwarder on another windows server 2008R2 machine say B. Following default ports have been opened between them. 9997,8089 ,8000

The above ports are opened only as outbound connectivity from source to destination.

We have checked the input and output configuration files too. However we are still unable to detect the forwarder in the splunk tool.
Please see the below conf files and snapshot of log files too. Let us know if anything else is required.

Input.conf (splunk from Machine A)

[default] host = <machine A>

# added from below

[tcp://<machine B IP >:9997] disabled = 0

`[tcp]
acceptFrom=*

connection_host=ip`

Pls see error msg in splunkd log from machine B where forwarder is installed.

03-20-2013 10:25:19.465 -0400 WARN DeploymentClient - Unable to send handshake message to deployment server. Error status is: rejected 03-20-2013 10:25:31.477 -0400 WARN DeploymentClient - Unable to send handshake message to deployment server. Error status is: rejected 03-20-2013 10:25:43.490 -0400 WARN DeploymentClient - Unable to send handshake message to deployment server. Error status is: rejected 03-20-2013 10:25:55.502 -0400 WARN DeploymentClient - Unable to send handshake message to deployment server. Error status is: rejected 03-20-2013 10:26:07.514 -0400 WARN DeploymentClient - Unable to send handshake message to deployment server. Error status is: rejected 03-20-2013 10:26:16.702 -0400 WARN PubSubConnection - Cannot convert str: to a valid status, returning eRejected.

Please HELP. Thanks in advance.

Thanks
Shivanshu

Re: Forwarder is not showing in Splunk

bmacias84 — Wed, 20 Mar 2013 14:56:50 GMT

Are you referring to forwarding data to Indexer or a Deployment Server. The Warning you have posted are related to Splunk Deployment Server not inputs.

Re: Forwarder is not showing in Splunk

jrodman — Wed, 20 Mar 2013 18:41:43 GMT

If you're trying to set up forwarding you should:
1 - show the outputs.conf configuration on the forwarder
2 - show any messages in splunkd.log on the forwarder about TcpOutput
3 - verify that when you send a packet to 9997 on the receiver that it gets there (for example network sniff on indexer.)

Re: Forwarder is not showing in Splunk

jrodman — Wed, 20 Mar 2013 18:45:55 GMT

Incidentally, those warnings are not related to your forwarder problem, unless they are just both indications of a network problem.

Re: Forwarder is not showing in Splunk

shivanshuk — Wed, 20 Mar 2013 19:12:17 GMT

I havent done any changes in output.conf file on forwarder. moreover couldnt find any output.conf at below location - \etc\system\local
Hence i have copied the default output .conf from default to local.
could find below error in splunkd logs
03-20-2013 05:20:23.449 -0400 ERROR TcpOutputProc - LightWeightForwarder/UniversalForwarder not configured. Please configure outputs.conf.

Re: Forwarder is not showing in Splunk

piebob — Wed, 20 Mar 2013 21:05:31 GMT

you must configure the outputs.conf on the forwarder. you must create this file if it does not exist. here is some introductory information about how configuration files work in general in Splunk: http://docs.splunk.com/Documentation/Splunk/latest/Admin/AboutConfigurationFiles

Re: Forwarder is not showing in Splunk

shivanshuk — Tue, 14 May 2013 13:29:23 GMT

All,

I have solved this issue by reinstalling the splunk and forwarder, something was messed up on my outputs.conf . 🙂