topic Re: Splunk forwarder not working in Getting Data In

Splunk forwarder not working

vramali1 — Mon, 28 Sep 2020 10:09:55 GMT

Hello I couldnt see the log files indexed in splunk
Could you please help and mafdetlogindexer is the index name in the remote system.
Is it rightly configured and am i missing something?

Inputs.conf

[monitor:///ngs/app/coecmsd/shared/Cluster/logs/Latest_Log_8888.txt]
index=default
sourcetype=sendcsapplogs

Outputs.conf

[tcpout:mafdetlogindexer]
server = mafdet.corp.apple.com:8888
maxQueueSize = 500KB

Thanks,
-VIjay

Re: Splunk forwarder not working

Damien_Dallimor — Tue, 29 Nov 2011 23:16:26 GMT

Ensure that the receiver port on mafdet.corp.apple.com is configured to listen on 8888 (9997 is the default)

And try something like this in your config files:

inputs.conf

[monitor:///ngs/app/coecmsd/shared/Cluster/logs/Latest_Log_8888.txt] 
index=mafdetlogindexer 
sourcetype=sendcsapplogs
disabled = false

outputs.conf

[tcpout]
defaultGroup = mafdetlogindexer
disabled = false

[tcpout:mafdetlogindexer] 
server = mafdet.corp.apple.com:8888 
maxQueueSize = 500KB

Re: Splunk forwarder not working

au_chrismor — Wed, 30 Nov 2011 02:36:57 GMT

I hit something very similar sounding, where the receiver simple did not.

The only way around it was do remove the receiver, restart and re-add.

Cheers