topic Re: How to connect the Windows Universal Forwarder to a Splunk Sandbox in Getting Data In

How to connect the Windows Universal Forwarder to a Splunk Sandbox

abolduc — Mon, 29 Dec 2014 20:23:36 GMT

Hello All,

I can't see to find the answer to getting the Windows Universal Forwarder connected to the online sandbox.

My output.conf file is:

[tcpout]
defaultGroup = default-autolb-group,sandbox

[tcpout:default-autolb-group]
disabled = false 
server = input-xxx-my-sandbox-url-xxx.cloud.splunk.com:9997

[tcpout:sandbox] 
disabled = false
server = input-xxx-my-sandbox-url-xxx.cloud.splunk.com:9997

Receiving is configured on my sandbox for port 9997 and I can telnet to it.

My splunkd.log file repeats the following msg:

12-29-2014 15:07:08.592 -0500 ERROR TcpOutputFd - Read error. An existing connection was forcibly closed by the remote host.
12-29-2014 15:07:14.307 -0500 INFO  DC:DeploymentClient - channel=tenantService/handshake Will retry sending handshake message to DS; err=not_connected
12-29-2014 15:07:26.309 -0500 INFO  DC:DeploymentClient - channel=tenantService/handshake Will retry sending handshake message to DS; err=not_connected
12-29-2014 15:07:38.310 -0500 INFO  DC:DeploymentClient - channel=tenantService/handshake Will retry sending handshake message to DS; err=not_connected
12-29-2014 15:07:38.593 -0500 ERROR TcpOutputFd - Read error. An existing connection was forcibly closed by the remote host.

I've also tried connect to my sandbox URL without the "input-" prefix. Anyone have some pointers as to what I'm missing?

Thanks

Re: How to connect the Windows Universal Forwarder to a Splunk Sandbox

ppablo — Mon, 29 Dec 2014 20:51:46 GMT

Hi @abolduc

Here are some previous related Splunk Answers posts that might be helpful:
http://answers.splunk.com/answers/147295/how-do-i-send-my-own-data-into-a-splunk-cloud-sandbox-trial.html
http://answers.splunk.com/answers/179646/how-to-forward-data-from-universal-forwarder-into.html

Re: How to connect the Windows Universal Forwarder to a Splunk Sandbox

abolduc — Mon, 29 Dec 2014 21:03:38 GMT

The first link is where I got the hint to prefix my sandbox URL with "input-". My config matches the one offered at the end of that post as well. The second link I've also see but I've manually configured my output.conf file; running the first command only results in a message that says "forwarded-server already present". Thanks

Re: How to connect the Windows Universal Forwarder to a Splunk Sandbox

ppablo — Thu, 22 Jan 2015 19:48:55 GMT

Hi @abolduc

Not sure if you already found your answer for this, but I saw on a previous post that the process for configuring a universal forwarder to send data to the sandbox had changed last month. According to @ryoung_splunk on this post:
http://answers.splunk.com/answers/149659/can-you-forward-data-to-the-sandbox-server-with-a-universal-forwarder.html

"Since early December 2014 the steps to use a forwarder in the sandbox have changed. To forward data to a sandbox you can use Universal Forwarder App available in Splunk Online Sandbox. The Universal Forwarder App includes the information and credentials necessary to download, install, and authorize you to forward data to Splunk Online Sandbox. After you sign in to Splunk Online Sandbox, choose Universal Forwarder from the Apps menu, and follow the Universal Forwarder app instructions."