https://community.splunk.com/t5/Getting-Data-In/How-to-troubleshoot-why-I-am-receiving-no-data-from-my-universal/m-p/160804#M32595 <P>Thanks Rich. Firewall isn't the problem. No local firewall. Both client and "server" are inside the firewall.</P> Fri, 27 Feb 2015 11:06:05 GMT gfaggiano 2015-02-27T11:06:05Z https://community.splunk.com/t5/Getting-Data-In/How-to-troubleshoot-why-I-am-receiving-no-data-from-my-universal/m-p/160801#M32592 <P>Okay... Here is my hangup. I've taken some training:<BR /> -What is Splunk<BR /> -Searching and Reporting<BR /> -Building Objects</P> <P>But... All my training was dealing with an environment that was already set up and configured. I have no training for what I'm trying to do!</P> <P>So I installed Universal Forwarder (newest available) on a Windows 7 workstation.<BR /> Default Ports</P> <P>I've installed an instance of Splunk Enterprise on another workstation in the same domain.<BR /> I setup to listen on the same port (9997?) I can't remember the port number off the top of my head <span class="lia-unicode-emoji" title=":face_with_tongue:">😛</span><BR /> I made sure the services were running and did a netstat to make sure the ports were getting through. all good.</P> <P>My problem is that I've tried setting up some data inputs, but i'm not sure I did it correctly because i'm getting no action from the forwarder.</P> <P>Here's a simple rundown of what I want to forward (to get me started):</P> <P>TCP bytes for:<BR /> 25<BR /> 80<BR /> 110<BR /> 443<BR /> 8080</P> <P>UDP bytes for:<BR /> 443</P> <P>Any guidance would be great!</P> Thu, 26 Feb 2015 18:33:49 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-troubleshoot-why-I-am-receiving-no-data-from-my-universal/m-p/160801#M32592 gfaggiano 2015-02-26T18:33:49Z https://community.splunk.com/t5/Getting-Data-In/How-to-troubleshoot-why-I-am-receiving-no-data-from-my-universal/m-p/160802#M32593 <P>Make sure Windows Firewall is not blocking the forwarder.</P> Thu, 26 Feb 2015 19:39:21 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-troubleshoot-why-I-am-receiving-no-data-from-my-universal/m-p/160802#M32593 richgalloway 2015-02-26T19:39:21Z https://community.splunk.com/t5/Getting-Data-In/How-to-troubleshoot-why-I-am-receiving-no-data-from-my-universal/m-p/160803#M32594 <P>Did you created a outputs.conf file on forwarder to send data to Indexer? If a correct outputs.conf is created, the forwarder should send forwarder's internal logs to your Indexers (without needing to setup an inputs.conf). Once you see internal logs (index=_internal host=yourforwarder), then you can setup data inputs.</P> Thu, 26 Feb 2015 21:02:30 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-troubleshoot-why-I-am-receiving-no-data-from-my-universal/m-p/160803#M32594 somesoni2 2015-02-26T21:02:30Z https://community.splunk.com/t5/Getting-Data-In/How-to-troubleshoot-why-I-am-receiving-no-data-from-my-universal/m-p/160804#M32595 <P>Thanks Rich. Firewall isn't the problem. No local firewall. Both client and "server" are inside the firewall.</P> Fri, 27 Feb 2015 11:06:05 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-troubleshoot-why-I-am-receiving-no-data-from-my-universal/m-p/160804#M32595 gfaggiano 2015-02-27T11:06:05Z https://community.splunk.com/t5/Getting-Data-In/How-to-troubleshoot-why-I-am-receiving-no-data-from-my-universal/m-p/160805#M32596 <P>Hi gfaggiano - </P> <P>Below link might help you. <BR /> <A href="http://answers.splunk.com/answers/218189/forwarders-not-forwarding.html#answer-218190">http://answers.splunk.com/answers/218189/forwarders-not-forwarding.html#answer-218190</A></P> Fri, 27 Feb 2015 11:17:03 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-troubleshoot-why-I-am-receiving-no-data-from-my-universal/m-p/160805#M32596 satishsdange 2015-02-27T11:17:03Z https://community.splunk.com/t5/Getting-Data-In/How-to-troubleshoot-why-I-am-receiving-no-data-from-my-universal/m-p/160806#M32597 <P>Thank you all for your responses. I still don't know why the data I requested wasn't sent by the forwarder. Fortunately, I didn't end up needing it because the same data was coming in from the event logs. Although I am academically curious, I was able to bring closure to my issue.</P> Mon, 02 Mar 2015 12:08:59 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-troubleshoot-why-I-am-receiving-no-data-from-my-universal/m-p/160806#M32597 gfaggiano 2015-03-02T12:08:59Z https://community.splunk.com/t5/Getting-Data-In/How-to-troubleshoot-why-I-am-receiving-no-data-from-my-universal/m-p/160807#M32598 <P>Take a look <A href="http://wiki.splunk.com/Community:Troubleshooting_Monitor_Inputs">here</A> as well for troubleshooting information.</P> Wed, 04 Mar 2015 17:48:56 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-troubleshoot-why-I-am-receiving-no-data-from-my-universal/m-p/160807#M32598 s2_splunk 2015-03-04T17:48:56Z