topic deployment-server question in Getting Data In

deployment-server question

fisk12 — Wed, 27 Apr 2011 21:18:40 GMT

in this manual http://www.splunk.com/base/Documentation/latest/Deploy/Extendedexampledeployseveralstandardforwarders

they say that i should run this command as part of configuration.

./splunk enable listen 9997 -auth :

when i do it on the machine that is supposed to work as a deployment server i get this error

./splunk enable listen 9997 -auth :

Command error: The subcommand 'listen' is not valid for command 'enable'.

Re: deployment-server question

jkerai — Wed, 27 Apr 2011 23:29:09 GMT

Could you provide the output of following command 'splunk version'. Can you check if you are running the command on indexer or Universal forwarder?

Re: deployment-server question

fisk12 — Thu, 28 Apr 2011 07:42:59 GMT

Splunk Universal Forwarder 4.2.1 (build 98164)

Am i supposed to run the command on the deployer-server or the client?

Re: deployment-server question

jkerai — Thu, 28 Apr 2011 14:44:51 GMT

It should be run on the indexer that will listen and receive data from from universal forwarder on port 9997. I am assuming that your indexer will serve the purpose of Deployment Server as well. If so, you can run the command on DeploymentServer/indexer.

Re: deployment-server question

Steve_G_ — Thu, 28 Apr 2011 17:18:17 GMT

Forwarders send data to receivers, which are usually indexers. The "enable listen" command is the command that you run on the receiver, not the forwarder. It allows the receiver to listen for data coming from a forwarder.

How you set up a deployment server to communicate with deployment clients is a separate issue, which is convered in the earlier steps in that example.

For more information on forwarding and receiving, refer to:

http://www.splunk.com/base/Documentation/latest/Deploy/Aboutforwardingandreceivingdata