topic Re: Unable to get universal forwarder to become active - Linux in Getting Data In

Unable to get universal forwarder to become active - Linux

jplangan — Tue, 16 Oct 2012 15:21:34 GMT

Hi, I have configured a basic splunk instance and it is indexing locally. I wanted to add a universal forwarder from another linux server and have the *nix app forward to the indexer. I have configured a data input on the indexer on port 9997 which shows as active (I checked it with strobe from another machine).

I installed the universal forwarder on a different server and set up the indexer as the forward server. It shows as inactive.
/opt/splunkforwarder/bin # ./splunk list forward-server
Your session is invalid. Please login.
Splunk username: admin
Password:
Active forwards:
None
Configured but inactive forwards:
:9997

Any help is appreciated.

Re: Unable to get universal forwarder to become active - Linux

yannK — Tue, 16 Oct 2012 15:44:56 GMT

The unix inputs goes to the "os" index by default, check in every indexes with index=*.
the UF have a slow thruput by default, it may still be forwarding old logs.
when you opened the port 9997 on the indexer, was it as tcp ( in the inputs manager), or as splunktcp (in the forward and received manager) ? The correct one is the second and look like [splunktcp://9997] in inputs.conf
no firewall ? try a telnet redactedservername 9997 from the forwarders

finally, read the logs in $SPLUNK_HOME/var/log/splunk/splunkd.log in both side.

Re: Unable to get universal forwarder to become active - Linux

jplangan — Tue, 16 Oct 2012 15:55:27 GMT

I used the wrong place to configure the receiving port. I needed to use Manager >> Forwarding and receiving >>Configure Receiving to configure it. It does now say that the forwarder is active.

I need to tell the forwarder what to send now, somehow.

Thanks!