no forwarder in splunk

shivanshuk — Thu, 28 Mar 2013 19:22:06 GMT

I have installed splunk on machine 1 and universal forwarder on machine 2. I can see on forwarder:

C:\Program Files\SplunkUniversalForwarder\bin>splunk list forward-server
Active forwards:
XXX.XX.XX.XXX:9997
Configured but inactive forwards:
None

however when i go and check in splunk, i don't see any forwarder details.
the C:\Program Files\Splunk\etc\system\local\inputs.conf is like below.

[default] host = <IP of machine where splunk is installed> [splunktcp://:9997] disabled = 0

The outputs.conf on forwarder is like below

[tcpout] defaultGroup = default-autolb-group [tcpout:default-autolb-group] server = <receiverIP>:9997 [tcpout-server://<receiverip>:9997]

I checked in splunkd logs in forwarder, there is no error corresponding to tcpout.
I am able to telnet on 9997 port from forwarder to receiver

Please advise.

Re: no forwarder in splunk

shivanshuk — Tue, 09 Apr 2013 10:19:24 GMT

i reinstallled splunk and forwarder ,a nd it is working now...
seems there was an issue with splunk server configs!!!!! 🙂