topic Splunk storm forwarder indexer configuration in Getting Data In

Splunk storm forwarder indexer configuration

lsudarshan — Fri, 11 Jan 2013 16:51:05 GMT

Hello all,

I am a novice splunk storm user and just installed the universal forwarder. But the installation expects a indexer ipaddress. I assumed as I was using splunk storm that I don't need to give this... its known by the installation. After installation, I ran the command "splunk.exe list forward-server" and get :

Active forwards:
        None
Configured but inactive forwards:
        forwarder.splunkstorm.com:9997

I tried telneting to forwarder.splunkstorm.com at port 9997 but that fails. Is this something to setup in splunk storm itself?

Appreciate any help.

Thanks,
Sudarshan

Re: Splunk storm forwarder indexer configuration

ChrisG — Fri, 11 Jan 2013 21:26:06 GMT

Did you start by downloading the credentials package from within your Splunk Storm project? See Set up a universal forwarder on Windows in the Splunk Storm documentation.

Re: Splunk storm forwarder indexer configuration

sdaniels — Fri, 11 Jan 2013 21:28:09 GMT

These should help you.

http://splunk-base.splunk.com/answers/58868/splunk-storm-trouble-adding-forwarders
http://splunk-base.splunk.com/answers/58992/datas-are-not-sent-from-my-machine-to-splunk-strom-web-ui

Re: Splunk storm forwarder indexer configuration

lsudarshan — Fri, 11 Jan 2013 22:31:27 GMT

Thanks for the answer Chris. I did indeed install the credentials package which created an app under the forwarder. But the command "splunk.exe list forward-server" still gives :

Active forwards:
None
Configured but inactive forwards:
forwarder.splunkstorm.com:9997

The curious thing is I can't telnet to forwarder.splunkstorm.com at port 9997.

Re: Splunk storm forwarder indexer configuration

ChrisG — Fri, 11 Jan 2013 22:37:28 GMT

Hm, then yeah, your firewall might be blocking something, or you might have a port issue from some setting in the AWS management console (see the first posting sdaniels listed). And you need to tell the forwarder what to monitor (see YannK's answer in the second posting that sdaniels listed). Beyond that, someone with deeper knowledge is going to have to help you here!

Re: Splunk storm forwarder indexer configuration

lsudarshan — Sat, 12 Jan 2013 10:57:01 GMT

Thanks Chris... will try it out.

Re: Splunk storm forwarder indexer configuration

lsudarshan — Sat, 12 Jan 2013 10:57:28 GMT

Thanks sdaniels. Will try these suggestions.

Re: Splunk storm forwarder indexer configuration

colares — Sat, 02 Mar 2013 21:09:37 GMT

I've solved this by allowing the port 9997 on firewall.

sudo ufw allow 9997