topic Re: How to find if a server has a universal forwarder installed, where it is sending logs to, or troubleshoot why it is not sending any logs? in Getting Data In

How to find if a server has a universal forwarder installed, where it is sending logs to, or troubleshoot why it is not sending any logs?

rashid47010 — Tue, 14 Jun 2016 09:00:46 GMT

hi everyone,

I am new to Splunk.. one of the servers is not sending the logs. So how can I know that a Splunk Universal Forwarder is installed on that server..?

secondly... if a UF is installed, then how can we find out where it is sending the logs to?
If it is not sending logs at all, then how to identify and troubleshoot the problem?

Re: How to find if a server has a universal forwarder installed, where it is sending logs to, or troubleshoot why it is not sending any logs?

Richfez — Tue, 14 Jun 2016 11:53:42 GMT

To find out if the Splunk Universal Forwarder (or indeed Splunk itself) is installed: For windows it's like any other program and will be listed as "Splunk" or "SplunkForwarder" in Add/Remove Programs. You can also find the folders in c:\Program Files. For *nix, usually Splunk of either variety is installed in /opt and you can confirm by perusing the output of "ps" or "top".

If there is no UF, there are still ways to get the logs into Splunk. In windows it's easy enough to "remotely collect" most logs via WMI and direct file access.

Troubleshooting a UF when it no longer is sending in logs usually isn't much more extreme than hopping onto the box in question and checking for errors in the Event Viewer or logs, perhaps restarting the service. You can check /opt/splunk/var/log/splunkforwarder/splunkd.log or c:\program files\splunkforwarder\var\log\splunk\splunkd.log for the last few pages of information to see if any ERRORs pop out. If the service is running and not showing errors, then it gets a bit more complex. Hopefully, the above will help you get it up and running.

Re: How to find if a server has a universal forwarder installed, where it is sending logs to, or troubleshoot why it is not sending any logs?

ddrillic — Tue, 14 Jun 2016 14:12:34 GMT

Which OS are you on?

Re: How to find if a server has a universal forwarder installed, where it is sending logs to, or troubleshoot why it is not sending any logs?

somesoni2 — Tue, 14 Jun 2016 17:59:53 GMT

Finding Splunk is installed OR not

Windows -
Go Run-> type services.msc and check splunk services are installed/available and are running

Linux
Run following command see if the splunk service is installed

service --status-all

OR use following check if SPlunk service is running

psef splunk | grep start

Find outputs.conf on the Forwarder find which Indexers/Intermediate Forwarder it's sending data to.

Re: How to find if a server has a universal forwarder installed, where it is sending logs to, or troubleshoot why it is not sending any logs?

rashid47010 — Mon, 20 Jun 2016 12:19:01 GMT

we have win2k8R2

Re: How to find if a server has a universal forwarder installed, where it is sending logs to, or troubleshoot why it is not sending any logs?

rashid47010 — Mon, 20 Jun 2016 12:21:01 GMT

while Installing the connector I add the IPAddress:port for depoloyment server but forget the add the IPAddress:port for indexer. How can I rerun the setup or what should I do that I start receiving the logs