topic Re: Configured but Inactive Forwards, inspite of resolving Firewall issue. Why? in Getting Data In

Configured but Inactive Forwards, inspite of resolving Firewall issue. Why?

smk54 — Mon, 25 May 2015 10:37:20 GMT

Hello

I am trying to configure a forwarder between a Linux Machine and a Windows machine. My Splunk is installed on the windows and the forwarder on Linux. I need to establish a connection between both so as to monitor the syslogs.

I have followed all the steps mentioned in "http://answers.splunk.com/answers/50082/how-do-i-configure-a-splunk-forwarder-on-linux.html" to configure the forwarder. But when i try to list the forwards, it says
Configured but inactive forwards:
137.254.237.30:9997
(the ip of my windows machine:port)
By doing more research I came to know that this could a firewall issue. I restarted the Windows firewall and added this port as an Inbound Rule for Splunk. But still, the forwarder is inactive.

Please help me out on this.

Re: Configured but Inactive Forwards, inspite of resolving Firewall issue. Why?

miteshvohra — Mon, 25 May 2015 11:12:16 GMT

There is a high possibility that the data you wish to forward is already sent and there is no more new data to be sent.

Try generating some events or run this eventgen to produce random samples, and then check the status.

Regards, Mitesh.

Re: Configured but Inactive Forwards, inspite of resolving Firewall issue. Why?

smk54 — Mon, 25 May 2015 13:34:16 GMT

Thanks a lot mitesh 🙂

I guess its a bug in version 5.0.4. The data had already been forwarded, however, the forward was still shown as inactive.

I would like to know one more thing. How can we remove the inactive forwards from that list in Linux? I deleted all the saved ones through the Splunk Web. But, the list is still appearing in Linux.

Re: Configured but Inactive Forwards, inspite of resolving Firewall issue. Why?

Herman — Wed, 24 Mar 2021 17:16:43 GMT

But what about universal forwarder? Could you install eventgen add on for universal forwarder? I have tried but no luck.

Have looked through several posts and checked everything, still having the forwards inactive.

Any help appreciated