topic Re: Why am I getting a timeout error trying to configure a Splunk Forwarder to send data to a Splunk indexer on AWS? in Getting Data In

Why am I getting a timeout error trying to configure a Splunk Forwarder to send data to a Splunk indexer on AWS?

ghosh84 — Thu, 23 Apr 2015 05:06:28 GMT

We plan to move our Splunk enterprise to Aws. The plan is to use a forwarder (from a local windows machine) to collect the data (around 15 mb a month) and send it to the indexer on aws.
I am trying to work on the forwarder - aws connection part, but i am getting a time out error.
My forwarder outputs.conf file looks like this :

tcpout-server =  amazon server:9997
sslcertpath =localpath /certificate.pen

I don't know what values to use for sslpassword and sslrootcapath.
I have also enabled the indexer to listen to 9997 port.
Where i am going wrong ?

Re: Why am I getting a timeout error trying to configure a Splunk Forwarder to send data to a Splunk indexer on AWS?

tachifelix — Thu, 23 Apr 2015 09:33:17 GMT

i thing that you can use a csv file.
so in search use output csv command to create a file and index it with your instance who in AWS

Re: Why am I getting a timeout error trying to configure a Splunk Forwarder to send data to a Splunk indexer on AWS?

ghosh84 — Thu, 23 Apr 2015 14:48:00 GMT

Mine will be a continuous monitoring system and not a one time upload.

Re: Why am I getting a timeout error trying to configure a Splunk Forwarder to send data to a Splunk indexer on AWS?

fdi01 — Fri, 24 Apr 2015 12:34:57 GMT

 sslCertPath = $SPLUNK_HOME/etc/apps/splunkclouduf/default/client.pem
sslPassword = fdf1c4601674ddd5fca3db0486d927db
sslRootCAPath = $SPLUNK_HOME/etc/apps/splunkclouduf/default/cacert.pem

but for you information :
Other reasons the forwarder might close a connection

There are actually three conditions that can cause the forwarder to close the network connection:

 1.   Read timeout. The forwarder doesn't receive acknowledgment within 300 (default) seconds. This is the condition described on this link:

`` http://docs.splunk.com/Documentation/Splunk/6.2.2/Forwarding/Protectagainstlossofin-flightdata#Other_reasons_the_forwarder_might_close_a_connection

 2.   Write timeout. The forwarder is not able to finish a network write within 300 (default) seconds. The value is configurable in outputs.conf by setting writeTimeout.

 3.   Read/write failure. Typical causes include the indexer's machine crashing or the network going down. 

4.   found the tcp port was not setup in the inputs.conf file. Added the tcp entry and it is working

In all these cases, the forwarder will then attempt to open a connection to the next indexer in the load-balanced group, or to the same indexer again if load-balancing is not enabled.