topic forwarding question in Getting Data In https://community.splunk.com/t5/Getting-Data-In/forwarding-question/m-p/27829#M4693 <P>Hello,<BR /> I want to configure 1 receiver, done! I want to have roughly 10-20 *nix systems sending data using forwarders.<BR /> I have some issues, any help is appreciated.</P> <P>I have a receiver: </P> <P>hostname is splunk, and it is listening on port 9997 as a receiver<BR /> I have a forwarded, let's call it HR.</P> <P>root@splunk:/opt/splunk# bin/splunk list forward-server<BR /> Your session is invalid. Please login.<BR /> Splunk username: admin<BR /> Password: <BR /> Active forwards:<BR /> None<BR /> Configured but inactive forwards:<BR /> hr:8089</P> <P>root@hr:/opt/splunk# bin/splunk list forward-server<BR /> Your session is invalid. Please login.<BR /> Splunk username: admin<BR /> Password:<BR /> Active forwards:<BR /> None<BR /> Configured but inactive forwards:<BR /> splunk:9997<BR /> root@hris:/opt/splunk#</P> <P>I am getting <EM>some</EM> data in splunk when I search by host="hr", but this host is not automatically added to my Unix app either. </P> <P>There are also all these errors:<BR /> 04-16-2012 17:08:19.001 -0400 ERROR TcpInputFd - ACCEPT_RESULT=-1 VERIFY_RESULT=0<BR /> 04-16-2012 17:08:19.001 -0400 ERROR TcpInputFd - SSL Error for fd from HOST:10.10.10.10, IP:10.10.10.10, PORT:39728<BR /> 04-16-2012 17:08:19.003 -0400 ERROR TcpInputFd - SSL Error = error:140760FC:SSL routines:SSL23_GET_CLIENT_HELLO:unknown protocol<BR /> 04-16-2012 17:08:19.003 -0400 ERROR TcpInputFd - ACCEPT_RESULT=-1 VERIFY_RESULT=0<BR /> 04-16-2012 17:08:19.003 -0400 ERROR TcpInputFd - SSL Error for fd from HOST:10.10.10.10, IP:10.10.10.10, PORT:39729<BR /> 04-16-2012 17:08:19.003 -0400 ERROR TcpInputFd - SSL Error = error:140760FC:SSL routines:SSL23_GET_CLIENT_HELLO:unknown protocol<BR /> 04-16-2012 17:08:19.003 -0400 ERROR TcpInputFd - ACCEPT_RESULT=-1 VERIFY_RESULT=0<BR /> 04-16-2012 17:08:19.003 -0400 ERROR TcpInputFd - SSL Error for fd from HOST:10.10.10.10, IP:10.10.10.10, PORT:39730</P> Mon, 28 Sep 2020 11:40:56 GMT roshanjan 2020-09-28T11:40:56Z forwarding question https://community.splunk.com/t5/Getting-Data-In/forwarding-question/m-p/27829#M4693 <P>Hello,<BR /> I want to configure 1 receiver, done! I want to have roughly 10-20 *nix systems sending data using forwarders.<BR /> I have some issues, any help is appreciated.</P> <P>I have a receiver: </P> <P>hostname is splunk, and it is listening on port 9997 as a receiver<BR /> I have a forwarded, let's call it HR.</P> <P>root@splunk:/opt/splunk# bin/splunk list forward-server<BR /> Your session is invalid. Please login.<BR /> Splunk username: admin<BR /> Password: <BR /> Active forwards:<BR /> None<BR /> Configured but inactive forwards:<BR /> hr:8089</P> <P>root@hr:/opt/splunk# bin/splunk list forward-server<BR /> Your session is invalid. Please login.<BR /> Splunk username: admin<BR /> Password:<BR /> Active forwards:<BR /> None<BR /> Configured but inactive forwards:<BR /> splunk:9997<BR /> root@hris:/opt/splunk#</P> <P>I am getting <EM>some</EM> data in splunk when I search by host="hr", but this host is not automatically added to my Unix app either. </P> <P>There are also all these errors:<BR /> 04-16-2012 17:08:19.001 -0400 ERROR TcpInputFd - ACCEPT_RESULT=-1 VERIFY_RESULT=0<BR /> 04-16-2012 17:08:19.001 -0400 ERROR TcpInputFd - SSL Error for fd from HOST:10.10.10.10, IP:10.10.10.10, PORT:39728<BR /> 04-16-2012 17:08:19.003 -0400 ERROR TcpInputFd - SSL Error = error:140760FC:SSL routines:SSL23_GET_CLIENT_HELLO:unknown protocol<BR /> 04-16-2012 17:08:19.003 -0400 ERROR TcpInputFd - ACCEPT_RESULT=-1 VERIFY_RESULT=0<BR /> 04-16-2012 17:08:19.003 -0400 ERROR TcpInputFd - SSL Error for fd from HOST:10.10.10.10, IP:10.10.10.10, PORT:39729<BR /> 04-16-2012 17:08:19.003 -0400 ERROR TcpInputFd - SSL Error = error:140760FC:SSL routines:SSL23_GET_CLIENT_HELLO:unknown protocol<BR /> 04-16-2012 17:08:19.003 -0400 ERROR TcpInputFd - ACCEPT_RESULT=-1 VERIFY_RESULT=0<BR /> 04-16-2012 17:08:19.003 -0400 ERROR TcpInputFd - SSL Error for fd from HOST:10.10.10.10, IP:10.10.10.10, PORT:39730</P> Mon, 28 Sep 2020 11:40:56 GMT https://community.splunk.com/t5/Getting-Data-In/forwarding-question/m-p/27829#M4693 roshanjan 2020-09-28T11:40:56Z Re: forwarding question https://community.splunk.com/t5/Getting-Data-In/forwarding-question/m-p/27830#M4694 <P>Did you ever find an answer to this? I'm getting the same thing for my redhat clients? Windows clients are fine. </P> Wed, 24 Jul 2013 19:53:29 GMT https://community.splunk.com/t5/Getting-Data-In/forwarding-question/m-p/27830#M4694 tschramm 2013-07-24T19:53:29Z