topic Re: Why is Universal Forwarder not forwarding? Standard install and all default configuration. in Getting Data In

Why is Universal Forwarder not forwarding? Standard install and all default configuration.

neiljpeterson — Thu, 05 Dec 2013 21:13:17 GMT

My installation of the Spunk is right out of the box, standard. I followed all the documentation to the letter, used all recommended settings, groups, names, ports, etc.

In the Splunk interface I configured receiving to listen to 9997. And I installed the Deployment Monitor app.

I installed the Universal Forwarder on a remote host and selected all the inputs and a directory with a log file. All other the defaults used (also using 9997)

I verified that the server is reachable and listening on the correct port from the remote host.

After all this the Deployment monitor still says No forwarders and no data is available in search.

What am I missing here?

Re: Why is Universal Forwarder not forwarding? Standard install and all default configuration.

Ayn — Thu, 05 Dec 2013 21:31:37 GMT

Did you actually add any inputs for the UF to read data from?

Re: Why is Universal Forwarder not forwarding? Standard install and all default configuration.

neiljpeterson — Thu, 05 Dec 2013 21:34:39 GMT

During the installation of UF? Yes I did, I selected all of them and a log file. Changed the post to reflect this.

Re: Why is Universal Forwarder not forwarding? Standard install and all default configuration.

lukejadamec — Thu, 05 Dec 2013 21:55:32 GMT

Restart the forwarder from a cmd window (run as admin) with the "c:\program files\splunkuniversalforwarder\bin\splunk.exe restart" command and look for errors. If there are none, then shortly after the restart look for errors in the splunk\var\log\splunk\splunkd.log file.

Re: Why is Universal Forwarder not forwarding? Standard install and all default configuration.

neiljpeterson — Thu, 05 Dec 2013 22:16:00 GMT

So I found that the host I was trying to receive data from had been set (possibly inadvertently by me or perhaps by someone else >:|) as another indexer to also send data to. I guess this caused a conflict in some way?

After I removed that configuration and restarted Splunk the host's data is now showing up!

Re: Why is Universal Forwarder not forwarding? Standard install and all default configuration.

lukejadamec — Fri, 06 Dec 2013 00:57:24 GMT

Beware the 'other' admins.