topic Re: unable to create centralized splunk server in Getting Data In

unable to create centralized splunk server

digitmon — Mon, 11 Apr 2011 18:42:00 GMT

i am using fc9 webservers my server pool 192.168.0.0/24 i crated one splunk centralized server i integrated all client servers but i cont get it my clients in splunk server i don't know how to create splunk client
pls guide me have i need to install any splunk package in client side

i followed below steps i installed splunk in 192.168..2 cd /opt sudo wget 'http://www.splunk.com/index.php/download_track?file=3.4.8/linux/splunk-3.4.8-54309-Linux-i686.tgz&ac=&wget=true&name=wget&typed=releases' sudo tar xvfz splunk-3.4.6-51113-Linux-i686.tgz sudo splunk/bin/splunk start

sudo /opt/splunk/bin/splunk enable boot-start sudo iptables -A INPUT -s ip.address1.to.allow -p tcp --dport 8000 -j ACCEPT sudo iptables -A INPUT -s ip.address2.to.allow -p tcp --dport 8000 -j ACCEPT sudo iptables -A INPUT -p tcp --dport 8000 -j DROP

in mys client system 192.168.0.23 in mys client system 192.168.0.24 in mys client system 192.168.0.25

i edit in mys client systems /etc/hosts

ip.address.of.splunkserver splunkserver

/etc/syslog.conf

additional config for sending logs to splunk

*.info @splunksever

i restarted network in my clints restarted splunk service in my centralized system /opt/splunk/bin/splunk restart its restarted sucsessfully i got web interface http://ipaddress:8000

i got iostat,user aditlogs information in my splunk server but i dint get my clint information pls guide me how to intigrate my clints with splunk server

thanks in addvance

Re: unable to create centralized splunk server

jbsplunk — Mon, 11 Apr 2011 22:19:37 GMT

It sounds like you are trying to set up a splunk indexer, and you'd like to set up forwarders to send data to that indexer, although I am not positive about that based on your description of the issue.

The first thing I noticed is that you are installing a 3.4 version of the product. I would recommend that you install the latest version of Splunk, which is 4.2. You are going to run into many problems that have been resolved since the release of that product.

You can find some useful information on installing here:

http://www.splunk.com/base/Documentation/latest/Installation/InstallonLinux

Information on settings up forwarding and receiving can be found here, with instructions as to how to configure each piece:

http://www.splunk.com/base/Documentation/latest/Deploy/Aboutforwardingandreceivingdata

Do you see your splunk forwarder attempting to make connections to your indexer in your splunkd.log in the $SPLUNK_HOME/var/log/splunk folder? That is the first place I would look for a clue as to what is happening. You may also want to look for connection messages related to the forwarder in the same location and same file on the Indexer.

Re: unable to create centralized splunk server

digitmon — Wed, 20 Apr 2011 06:10:59 GMT

hi jbsplunk
thanks for your giving documentation but i am new in splunk i installed splun one machine forwarder i installed my remote system i enable receiver im my system but i didn't get the forworder data on my spluk server i didn't understand what is the reason to up my forwarder system in splunk server
pls guide me how to up the splunk forwarder on my splunk server

Re: unable to create centralized splunk server

jbsplunk — Thu, 05 May 2011 17:52:48 GMT

I have edited my first answer with some additional questions with regard to what you are seeing in the logs. This may provide helpful information as to the nature of your problem.