topic Re: Universal Forwarder, Server Class. in Getting Data In

Universal Forwarder, Server Class.

test_qweqwe — Thu, 23 Nov 2017 11:20:52 GMT

I install UF on linux client.
Than I

./splunk set deploy-poll *.*.*.*:8089

Client did not appear in Forwarder Management in Clients.

What i miss?

Re: Universal Forwarder, Server Class.

gcusello — Thu, 23 Nov 2017 11:47:08 GMT

Hi test_qweqwe,
did you restarted Splunk?
did you checked if port 8089 is open (telnet xx.xx.xx.xx 8089)

Bye.
Giuseppe

Re: Universal Forwarder, Server Class.

test_qweqwe — Thu, 23 Nov 2017 11:58:42 GMT

Yes, I restarted and port is open.

Re: Universal Forwarder, Server Class.

gcusello — Tue, 29 Sep 2020 16:56:19 GMT

check in $SPLUNK_HOME/etc/system/local/server.conf and $SPLUNK_HOME/etc/system/local/inputs.conf if hostname is correct or is duplicated with another machine.
Bye.
Giuseppe

Re: Universal Forwarder, Server Class.

lycollicott — Thu, 23 Nov 2017 16:08:13 GMT

Verify that it created $SPLUNK_HOME/etc/system/local/deploymentclient.conf and that it is correct.

Re: Universal Forwarder, Server Class.

test_qweqwe — Sat, 25 Nov 2017 18:12:46 GMT

All is good.

Re: Universal Forwarder, Server Class.

test_qweqwe — Sat, 25 Nov 2017 18:14:58 GMT

deploymentclient.conf created and it's correct.

Re: Universal Forwarder, Server Class.

gcusello — Sat, 25 Nov 2017 18:24:04 GMT

Try to manually install an outputs.conf to send logs to indexers and see if forwarder sends logs.
Bye.
Giuseppe

Re: Universal Forwarder, Server Class.

test_qweqwe — Sat, 25 Nov 2017 20:11:53 GMT

The problem was in AWS Security policis which was block ports. Now my client is in Forwarder Management.
But the problem is that I accidentally removed $SPLUNK_HOME/etc/system/local/outputs.conf

It's big problem or not?

Re: Universal Forwarder, Server Class.

ddrillic — Sat, 25 Nov 2017 22:16:48 GMT

Normally $SPLUNK_HOME/etc/system/local/outputs.conf is empty while $SPLUNK_HOME/etc/apps/<your deployment app>/local/outputs.conf has the output information.

Re: Universal Forwarder, Server Class.

gcusello — Sun, 26 Nov 2017 10:41:15 GMT

Hi test_qweqwe,
the best approach to outputs.conf is to create a Technical Add-On (TA) containing only outputs.conf to deploy using a Deployment server, so you can centrally manage your outputs.conf.

But if you have the described problem you can manually create your outputs.conf in two ways:

copying from an example ( see https://docs.splunk.com/Documentation/Splunk/7.0.0/Admin/Outputsconf )
launching by CLI the following command

./splunk add forward-server :

in both the cases restart Splunk.

Bye.
Giuseppe

Re: Universal Forwarder, Server Class.

test_qweqwe — Sun, 26 Nov 2017 17:55:50 GMT

In my UF I used this command: ./splunk add monitor /var/log
And it's created stanza [monitor///] in /opt/splunkforwarder/etc/apps/search/local/inputs.conf

How me easy create TA in my deployment server to send it to UF?

Re: Universal Forwarder, Server Class.

gcusello — Mon, 27 Nov 2017 07:49:13 GMT

Hi test_qweqwe,
It isn't so easy to describe in few words!
Follow the instructions on https://docs.splunk.com/Documentation/Splunk/7.0.0/Updating/Aboutdeploymentserver to understand how Deployment Server works and how to configure and use it.

Anyway, in your last comment you spoke about a different things, the command ./splunk add monitor /var/log is useful to add a monitor stanza to inputs.conf, instead I spoke about outputs.conf, that is the way to say to the forwarder which are the indexer to send data.

Bye.
Giuseppe