https://community.splunk.com/t5/Getting-Data-In/Connect-to-my-server/m-p/19379#M2749 <P>thanks for the quick reply sdanniels</P> <P>ah yes that's the output.conf on the forwarder. I didn't have that setting on the indexer inputs.conf so it now looks like this:</P> <P>[default] host = winxphostname</P> <P>[splunktcp://9997]</P> <P>still can;t see anything in the deployment monitor and now I'm not sure where to look for clues as to what's wrong <span class="lia-unicode-emoji" title=":disappointed_face:">😞</span></P> Fri, 27 Jul 2012 12:29:03 GMT rgill90 2012-07-27T12:29:03Z https://community.splunk.com/t5/Getting-Data-In/Connect-to-my-server/m-p/19377#M2747 <P>Hi All </P> <P>I'm trying Splunk for the first time - I'm sifting through the documentation and finding it difficult to ascertain how to install forwarder and do a very basic config with an indexer.</P> <P>Installed it on my win xp desktop as the indexer and installed the forwader on a test Linux machine. The linux forwarder inputs.conf looks like this:</P> <P>[tcpout]<BR /> defaultGroup = hostnameofwindowslaptop_9997</P> <P>[tcpout:hostnameofwindowslaptop_9997]<BR /> server = hostnameofwindowslaptop:9997</P> <P>[tcpout-server://hostnameofwindowslaptop:9997]</P> <P>in the windows server logs i constantly get this:</P> <P>07-27-2012 11:40:39.274 +0100 ERROR TcpOutputFd - Connection to host=forwarderIP:9997 failed<BR /> 07-27-2012 11:40:39.274 +0100 WARN TcpOutputProc - Applying quarantine to idx=forwarderIP:9997 numberOfFailures=11</P> <P>...and on the forwarder in the splunkd.log i get exactly the same error messages.</P> <P>Can anyone give me any pointers to troubleshoot this? I've tried searching for errors in the web gui search bar over the passed 24 hours and it tells me there's no errors. My forwarder doesn't show in the 'datasources' bit on the search screen either. Bit stumped <span class="lia-unicode-emoji" title=":disappointed_face:">😞</span> Thanks in advance!</P> Fri, 27 Jul 2012 10:48:53 GMT https://community.splunk.com/t5/Getting-Data-In/Connect-to-my-server/m-p/19377#M2747 rgill90 2012-07-27T10:48:53Z https://community.splunk.com/t5/Getting-Data-In/Connect-to-my-server/m-p/19378#M2748 <P>Do you mean outputs.conf on the forwarder? The inputs file on the forwarder will configure what you are monitoring for data, not the connection back to the indexer server. What you have above looks like configurations i'd expects in outputs.conf on the forwarder. </P> <P>Check on the indexer inputs.conf to make sure you have this setting as well:</P> <P>[splunktcp://9997]</P> Fri, 27 Jul 2012 11:11:29 GMT https://community.splunk.com/t5/Getting-Data-In/Connect-to-my-server/m-p/19378#M2748 sdaniels 2012-07-27T11:11:29Z https://community.splunk.com/t5/Getting-Data-In/Connect-to-my-server/m-p/19379#M2749 <P>thanks for the quick reply sdanniels</P> <P>ah yes that's the output.conf on the forwarder. I didn't have that setting on the indexer inputs.conf so it now looks like this:</P> <P>[default] host = winxphostname</P> <P>[splunktcp://9997]</P> <P>still can;t see anything in the deployment monitor and now I'm not sure where to look for clues as to what's wrong <span class="lia-unicode-emoji" title=":disappointed_face:">😞</span></P> Fri, 27 Jul 2012 12:29:03 GMT https://community.splunk.com/t5/Getting-Data-In/Connect-to-my-server/m-p/19379#M2749 rgill90 2012-07-27T12:29:03Z https://community.splunk.com/t5/Getting-Data-In/Connect-to-my-server/m-p/19380#M2750 <P>well it seems i just had to wait and be patient....suddenly started appearing...gawd knows why / how but the only change i did was the one above</P> Fri, 27 Jul 2012 12:43:33 GMT https://community.splunk.com/t5/Getting-Data-In/Connect-to-my-server/m-p/19380#M2750 rgill90 2012-07-27T12:43:33Z https://community.splunk.com/t5/Getting-Data-In/Connect-to-my-server/m-p/19381#M2751 <P>Do you have any events being indexed?</P> Fri, 27 Jul 2012 13:07:13 GMT https://community.splunk.com/t5/Getting-Data-In/Connect-to-my-server/m-p/19381#M2751 iunderwood 2012-07-27T13:07:13Z