topic Re: universal forwarder in Getting Data In

universal forwarder

sarah89 — Thu, 05 Apr 2012 15:43:00 GMT

please I need help ,

I deployed a universal forward by following tutorial "distributed deployement manual"

The universal forward is in the machine configured like this:

inputs.conf
[default]
host = atelcom-62de949

[monitor://Documents and Settings\sarah\Bureau\splunk image]
disabled = false

output.conf

[tcpout]
defaultGroup = 192.168.0.45_9997
[tcpout:192.168.0.45_9997]
server = 192.168.0.45:9997
[tcpout-server://192.168.0.45:9997]

The Splunk instance (the indexer) is installed in a windows server 2008 virtual machine.
I enable the receiver but when i use the deployment monitor to see the forwarder and I don't find anything from it, it doesn't seem to be working.
Can you please tell me how to fix this?

Re: universal forwarder

jbsplunk — Thu, 05 Apr 2012 15:56:11 GMT

Could you provide some details around what you're seeing in Splunkd.log around connections to the indexer?

Re: universal forwarder

MHibbin — Thu, 05 Apr 2012 16:06:38 GMT

Shouldn't the file path in the monitor stanza be absolute, i.e. include the disk. for example...

[monitor://C:\Documents and Settings\sarah\Bureau\splunk image]

Or whatever the location may be... I've always used the absolute path to be certain.

Re: universal forwarder

twkan — Fri, 06 Apr 2012 03:42:10 GMT

I am not sure if it's a typo error, but can you verify your file is outputs.conf and not output.conf like what you have mentioned?

Re: universal forwarder

sarah89 — Sun, 08 Apr 2012 07:46:41 GMT

i checked it ,it outputs.conf not output.conf
it's was just a typo error

Re: universal forwarder

sarah89 — Sun, 08 Apr 2012 07:47:52 GMT

how can i see the splunkd.log around connections to the indexer

Re: universal forwarder

sarah89 — Sun, 08 Apr 2012 08:42:44 GMT

thk's i will try to add this to the path

Re: universal forwarder

sarah89 — Sun, 08 Apr 2012 10:45:30 GMT

i still have the problem , please tell what i shoul do to fix this

Re: universal forwarder

MarioM — Sun, 08 Apr 2012 10:51:59 GMT

check if any error in your Forwarder splunkd.log (splunkforwarder\var\log\splunk\)

Re: universal forwarder

sarah89 — Sun, 08 Apr 2012 11:04:42 GMT

i have only info and warm like this
04-08-2012 11:59:01.265 +0100 INFO TailingProcessor - Could not send data to output queue (parsingQueue), retrying...

4-08-2012 12:01:25.781 +0100 WARN TcpOutputProc - Cooked connection to ip=192.168.0.45:9997 timed ou

Re: universal forwarder

sarah89 — Sun, 08 Apr 2012 11:16:09 GMT

tell me please , how the inputs.conf and outputs.conf of the indexer looks like ?

Re: universal forwarder

sarah89 — Thu, 12 Apr 2012 08:13:25 GMT

hello alls

please can anyone help me , i'm stucking here , i couldn't figure it out

Re: universal forwarder

Ayn — Thu, 12 Apr 2012 08:42:56 GMT

Can you connect to the indexer on port 9997 from the host you're running the Universal Forwarder on?

Re: universal forwarder

sarah89 — Thu, 12 Apr 2012 09:01:33 GMT

splunk server :

Process= splunkd.exe
PID=1360
Protocol= TCP
Local address= lab2008
Local port =9997
Remote address= lab2008
Remote port=0
Stat= LISTENING

universal forwarder :

Process= splunkd.exe
PID=1332
Protocol= TCP
Local address= atelcom-62de949.ssg20-wlan
Local port =1215
Remote address= lab2008
Remote port=9997
Stat= etablished

Re: universal forwarder

Ayn — Thu, 12 Apr 2012 09:13:25 GMT

You should have a look at splunkd.log on the indexer to see what error messages you're getting. Ideas on possible problems: non-SSL connection to an SSL enabled listening port, mismatch on compression settings.

Re: universal forwarder

sarah89 — Thu, 12 Apr 2012 10:42:17 GMT

thk's a lot , i get it

Re: universal forwarder

sarah89 — Thu, 12 Apr 2012 11:04:48 GMT

i had to disable the firewalls of windows server 2008