topic Re: Forwarder Configuration - Cloud Setup in Getting Data In

Forwarder Configuration - Cloud Setup

mailmetoramu — Mon, 19 Mar 2018 10:02:59 GMT

Hi,

Have installed universal forwardesr in my linux machines & configured as below :

Step 1: ./splunk add forward-server :

Step 2 : ./splunk set deploy-poll :

Step 3 : ./splunk add monitor /var/log ( Configured data inputs on the forwarder )

Step 4 : Re-started the splunk.

But after all these steps still its showing error like below

Error no 1 : ''Forwarder not configured'' please configure outputs.conf

Error no 2 : ''Forwarder not active''.

Please do let me know the correct configurations.

Thanks in advance ..!!

Re: Forwarder Configuration - Cloud Setup

p_gurav — Mon, 19 Mar 2018 12:58:16 GMT

Can you check ./splunk list forward-server? Is there any forwarder in active list? Also make sure all required ports are open between forwarder and deployment server.

Re: Forwarder Configuration - Cloud Setup

mailmetoramu — Mon, 19 Mar 2018 16:15:19 GMT

Hi Gaurav,

Yes already executed that command as well but getting the below error :

Active forwards: None

Configured but inactive forwards:

Re: Forwarder Configuration - Cloud Setup

gneumann_splunk — Mon, 19 Mar 2018 17:05:40 GMT

I don't see where you have added your cloud credentials.

Confirm you have followed these steps:
http://docs.splunk.com/Documentation/SplunkCloud/7.0.0/User/ForwardDataToSplunkCloudFromLinux

Re: Forwarder Configuration - Cloud Setup

mailmetoramu — Tue, 20 Mar 2018 09:06:28 GMT

Hi Gnewmann,

Apart from the above steps you mentioned, before that please let me know whether after installing Forwarders do i need configure outputs.conf or inuts.conf apart from Deployemnt server.conf & forwarder.conf

Thanks,

Ramu.R

Re: Forwarder Configuration - Cloud Setup

p_gurav — Tue, 20 Mar 2018 09:37:14 GMT

Is there any error in _internal? Also did you configure receiving on indexer with 9997?

Re: Forwarder Configuration - Cloud Setup

gneumann_splunk — Tue, 20 Mar 2018 18:46:05 GMT

For self-service deployments, if you follow the steps in http://docs.splunk.com/Documentation/SplunkCloud/7.0.0/User/ForwardDataToSplunkCloudFromLinux using Splunk Web (the Splunk user interface), you should be successful in configuring your universal forwarder and making a connection to your Splunk Cloud instance. Be sure to follow closely Steps 3, 4, and 5, and you should only have to configure the deployment server as noted in the instructions.

After following these steps, you should see your forwarder, and you should be able to configure data inputs.

You should not have to configure the outputs.conf, inputs.conf or forwarder.conf separately from the instructions listed in the link above to make a connection to your forwarder. The configuration instructions for outputs.conf and inputs.conf are for a Splunk Enterprise instance, not Splunk Cloud. This might be confusing in the Forwarding Data guide.

Please let me know if you are successful. If you continue to have issues, or you have a managed Splunk Cloud deployment, I can put you in touch with someone else that might be able to further help troubleshoot this issue.

Re: Forwarder Configuration - Cloud Setup

mailmetoramu — Wed, 21 Mar 2018 09:39:22 GMT

Will try the mentioned steps & keep you posted.

Anywazz thanks you so much Gneumann...