https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-forward-data-to-a-Splunk-Free-license/m-p/308325#M58074 <P>Thanks<BR /> nickhillscpl : Yes I have configured Receiver, Yes I opened port 9997 on firewall for TCP ( should it be udp?)<BR /> No I have not configured any this special on indexer. on the tutorial video there is no mention of setting indexer.<BR /> Where could I find this?</P> <P>HiroshiSatoh : I only access data from search head. When i click on "data summary" I can see other host I used in the past but I cannot see the ip of forwarding server. this is available on the fulled licensed server.</P> <P>Is there some log on the Forwarding server I could look telling me "cannot contact indexer because..."?</P> Mon, 16 Oct 2017 10:32:58 GMT pdevosceazure 2017-10-16T10:32:58Z https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-forward-data-to-a-Splunk-Free-license/m-p/308321#M58070 <P>I am trying to forward logs from a linux server to a Splunk Free indexer instance.<BR /> I know my forwarder is set up correctly because I can forward data to a fully licensed splunk indexer OK.<BR /> But when I switch the target server to the free license indexer i don't receive anything.</P> <P>Q: Is it possible to use universal forwarder to send data to a splunk free indexer ( not a trial license)?<BR /> I have seen a good few answers but they all talk about forwarding FROM Splunk free not forwarding TO splunk free.<BR /> I have seen the "MoreaboutSplunkFree" page <BR /> <A href="http://docs.splunk.com/Documentation/Splunk/latest/Admin/MoreaboutSplunkFree">http://docs.splunk.com/Documentation/Splunk/latest/Admin/MoreaboutSplunkFree</A><BR /> but again restrictions seem to be about about forwarding <STRONG>from</STRONG> not <STRONG>to</STRONG> Splunk free.</P> Mon, 16 Oct 2017 09:05:58 GMT https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-forward-data-to-a-Splunk-Free-license/m-p/308321#M58070 pdevosceazure 2017-10-16T09:05:58Z https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-forward-data-to-a-Splunk-Free-license/m-p/308322#M58071 <P>You should be able to do this - as you correctly state, the free version limits your ability to configure a distributed environment (hence <STRONG>From</STRONG>).</P> <P>There are no restrictions using a UF to send data <STRONG>to</STRONG> a system running the free licence.</P> <P>Silly questions therefore follow:<BR /> Have you configured receiving ports?<BR /> Indexes?<BR /> Firewalls?</P> Mon, 16 Oct 2017 10:18:19 GMT https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-forward-data-to-a-Splunk-Free-license/m-p/308322#M58071 nickhills 2017-10-16T10:18:19Z https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-forward-data-to-a-Splunk-Free-license/m-p/308323#M58072 <P>What is the reason?<BR /> Data is transferred to the indexer, but it can not be retrieved from the search head.</P> Mon, 16 Oct 2017 10:20:29 GMT https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-forward-data-to-a-Splunk-Free-license/m-p/308323#M58072 HiroshiSatoh 2017-10-16T10:20:29Z https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-forward-data-to-a-Splunk-Free-license/m-p/308324#M58073 <P>In Splunk "free" there is no search head/indexer - Its a single box deployment only...<BR /> Although... that raises a good question if you were on Ent Trial, and had previously configured distributed search before the lic reverted to free</P> Mon, 16 Oct 2017 10:25:23 GMT https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-forward-data-to-a-Splunk-Free-license/m-p/308324#M58073 nickhills 2017-10-16T10:25:23Z https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-forward-data-to-a-Splunk-Free-license/m-p/308325#M58074 <P>Thanks<BR /> nickhillscpl : Yes I have configured Receiver, Yes I opened port 9997 on firewall for TCP ( should it be udp?)<BR /> No I have not configured any this special on indexer. on the tutorial video there is no mention of setting indexer.<BR /> Where could I find this?</P> <P>HiroshiSatoh : I only access data from search head. When i click on "data summary" I can see other host I used in the past but I cannot see the ip of forwarding server. this is available on the fulled licensed server.</P> <P>Is there some log on the Forwarding server I could look telling me "cannot contact indexer because..."?</P> Mon, 16 Oct 2017 10:32:58 GMT https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-forward-data-to-a-Splunk-Free-license/m-p/308325#M58074 pdevosceazure 2017-10-16T10:32:58Z https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-forward-data-to-a-Splunk-Free-license/m-p/308326#M58075 <P>try searching for: <CODE>index=_internal host=&lt;your missing host name&gt;</CODE><BR /> Although I suspect that it may come back empty!<BR /> Then take a look at the <CODE>/opt/splunkforwarder/var/log/splunk/splunkd.log</CODE> file - Look for any connection attempts specifically to port 9997. (yes it is normally TCP)</P> <P>How did you configure your forwarder?</P> Mon, 16 Oct 2017 13:06:41 GMT https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-forward-data-to-a-Splunk-Free-license/m-p/308326#M58075 nickhills 2017-10-16T13:06:41Z https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-forward-data-to-a-Splunk-Free-license/m-p/308327#M58076 <P>Distributed configuration is not possible with the free version. Can you search on the indexer's server?</P> Mon, 16 Oct 2017 13:27:27 GMT https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-forward-data-to-a-Splunk-Free-license/m-p/308327#M58076 HiroshiSatoh 2017-10-16T13:27:27Z