topic Re: How can I forward data in Windows Universal Splunk Forwarder 6.5.0 and a CentOS Splunk Entreprise 6.5.0? in Getting Data In

How can I forward data in Windows Universal Splunk Forwarder 6.5.0 and a CentOS Splunk Entreprise 6.5.0?

myitlab1000 — Thu, 15 Mar 2018 15:54:11 GMT

Hi, i'm sorry for my poor English, I have a Windows Universal Splunk Forwarder 6.5.0 and a CentOS Splunk Entreprise 6.5.0. I added a new index. I edited and added index = myindex" to "etc\apps\SplunkUniversalForwarder\local\inputs.conf, restated windows service, and tested again with "etc\system\local\inputs.conf", but no data is forwarded in my index or in the main index with default conf. Thank you for your help

Re: How can I forward data in Windows Universal Splunk Forwarder 6.5.0 and a CentOS Splunk Entreprise 6.5.0?

JDukeSplunk — Thu, 15 Mar 2018 17:23:08 GMT

First, if the index you are pointing to is not listed under your security role as "default search" you will need to specify index in the search string. This is always good practice anyway.

index=YOURINDEX OR index=SOMEOTHERINDEX

index=*

The data may not know where to go. You may need to edit/create a ../etc/system/local/outputs.conf

https://docs.splunk.com/Documentation/Forwarder/7.0.2/Forwarder/Configureforwardingwithoutputs.conf

Here is an example of mine where I use two indexers.

[tcpout:group1]
server = hostname.domainname.com:9997,hostname.domainname.com:9997

[tcpout]
defaultGroup = group1

You may also need to create the index on the indexer you are pointing to. If it does not exist the data will fail to reach it's destination.

Re: How can I forward data in Windows Universal Splunk Forwarder 6.5.0 and a CentOS Splunk Entreprise 6.5.0?

gcusello — Tue, 29 Sep 2020 18:30:39 GMT

Hi myitlab1000,
there could be many reason of this:

did you enabled receiving on your Splunk Enterprise?
did you configured your outputs.conf on your Forwarder?
are you sure that routes are opened between Forwarder and Splunk Enterprise on 9997 port?

to set point 1 see [Settings -- Receiving and Forwarding -- Receiving] if there's on port enabled, usually 9997, dor more information see https://docs.splunk.com/Documentation/Splunk/7.0.2/Forwarding/Enableareceiver .

To configure point 2 run
$SPLUNK_HOME\splunkuniversalforwarder\splunk\bin\splunk add forward-server :
foe more information see http://docs.splunk.com/Documentation/Forwarder/7.0.2/Forwarder/Configuretheuniversalforwarder .

To test point three use
telnet Splunk_Enterprise_IP 9997

Bye.

Giuseppe

Re: How can I forward data in Windows Universal Splunk Forwarder 6.5.0 and a CentOS Splunk Entreprise 6.5.0?

myitlab1000 — Fri, 16 Mar 2018 07:41:55 GMT

Hi All,

Thank you very much for all your answers.
Thank you for your so fast answers.

Il found my problem.

On Windows forwarder, in my "inputs.conf", i set index value with quote like this : index = "myindex".

And as it says in Splunk documentation for inputs.conf, WARNING: Do not put the value in quotes. Use host=foo, not host="foo".

Thanks again,

Bye

Re: How can I forward data in Windows Universal Splunk Forwarder 6.5.0 and a CentOS Splunk Entreprise 6.5.0?

richgalloway — Fri, 16 Mar 2018 12:36:51 GMT

@myitlab1000, if your problem is resolved, please accept an answer to help future readers.