topic Re: Universal forwarder is not working as an intermediate forwarder. in Getting Data In

Universal forwarder is not working as an intermediate forwarder.

asingla — Tue, 18 Oct 2011 15:24:34 GMT

I have the below deployment topology

Program -> Universal Forwarder (UF1) -> Universal Forwarder (UF2) (Intermediate) -> Main Indexer

'->' the flow of TCP message originated from the Program.

I don't see the messages reaching to the main indexer.

Main Indexer is installed on host3 and listening on 44444.

I used command lines to configure the universal forwarders as below

UF2 in installed on host2 and configure to listen on 33333 for tcp messages and forwarding to main indexer.

1) splunk add tcp 33333

2) splunk add forwarder-server host3:44444

UF1 is installed on host1 and configure to listen on 22222 for tcp messages and forwarding to universal forwarder installed on host2.

1) splunk add tcp 22222

2) splunk add forwarder-server host2:33333

My program is sending tcp message to UF1 and I don't see that message reaching all the way to main indexer. FYI, If I configure UF1/UF2 to directly send messages to main indexer , that works for me.

Re: Universal forwarder is not working as an intermediate forwarder.

Steve_G_ — Tue, 18 Oct 2011 18:04:57 GMT

You need to make UF2 a receiver for data getting forwarded from UF1. To enable it, use this command:

./splunk enable listen -auth :

In your case, would be 33333.

See this topic for more details:

http://docs.splunk.com/Documentation/Splunk/latest/Deploy/Enableareceiver

Re: Universal forwarder is not working as an intermediate forwarder.

asingla — Tue, 18 Oct 2011 18:21:00 GMT

That's what I tired at the first place.
./splunk enable listen 33333

Bit I got a command error:

Command error: The subcommand 'listen' is not valid for command 'enable'.

Looks like this command is not supported in Universal Forwarder.

So I thought that I would just add a tcp listener instead.

Re: Universal forwarder is not working as an intermediate forwarder.

Steve_G_ — Tue, 18 Oct 2011 18:59:02 GMT

Try adding this stanza to the inputs.conf file on UF2:

[splunktcp://33333]

Re: Universal forwarder is not working as an intermediate forwarder.

asingla — Thu, 02 Feb 2012 14:19:35 GMT

It works. So it's just the CLI bug. Thanks.