topic Re: Universal forwarder not forwarding to other linux/windows in Getting Data In

Universal forwarder not forwarding to other linux/windows

rakeshksingh — Wed, 04 Apr 2018 18:47:32 GMT

I have installed Uf in one linux and splunk instance in another linux/windows. While trying to configure , uf is not forwarding data to linux/windows splunk,ping is working fine.

Could you please help me on this.

Re: Universal forwarder not forwarding to other linux/windows

robgora_deloitt — Wed, 04 Apr 2018 20:22:54 GMT

Have you validated that your Splunk indexer is listening on port 9997 and that your UF is configured in the outputs.conf to send to your indexer over port 9997? I would also validate that you have port 9997 open in your firewall as well. You can validate this with telnet.

Re: Universal forwarder not forwarding to other linux/windows

rakeshksingh — Thu, 05 Apr 2018 16:29:50 GMT

i have configured outputs.conf (ip:9997) in linux universal forwarder and at splunk instances configured receiver as 9997. but still not working.
i have stop firewall with sudo ufw disable and tried. but still not working

Re: Universal forwarder not forwarding to other linux/windows

rakeshksingh — Thu, 05 Apr 2018 16:30:08 GMT

Re: Universal forwarder not forwarding to other linux/windows

robgora_deloitt — Thu, 05 Apr 2018 16:34:26 GMT

Can you telnet over port 9997? Also have you checked the physical firewall to ensure that the ports are open?

Re: Universal forwarder not forwarding to other linux/windows

rakeshksingh — Thu, 05 Apr 2018 17:15:25 GMT

its working fine with heavy forwarder but not with universal forwarder

Re: Universal forwarder not forwarding to other linux/windows

skulk — Thu, 05 Apr 2018 17:21:30 GMT

Hi!
1) Try to restart frowarder
2) Check index = _internal for forwarder logs existence

If it is not working, please provide us full your outputs.conf config

Re: Universal forwarder not forwarding to other linux/windows

robgora_deloitt — Thu, 05 Apr 2018 17:55:05 GMT

I would also check the _internal on the Splunk Indexer to see if you can see the UF host connecting to the Indexer. Is the host anywhere in the logs? It could be that the server is connecting but your app has an issue with it's input.conf