https://community.splunk.com/t5/Getting-Data-In/Error-messages-when-I-try-to-connect-the-universal-forwarder/m-p/369507#M67068 <P>Hi dougsummersett,<BR /> the first messages means that the new UFs cannot connect to the Deployment Server.<BR /> You can test this using telnet on the management port (usually 8089).<BR /> Did you configured Deployment Server?<BR /> If not, message isn't important.<BR /> If yes and connection is OK, check if your UF is seen by the Deployment Server.</P> <P>When you say: "The deployment is setup to listen on port 9997." are you speaking of Indexer?</P> <P>To debug connection with Indexers, at first test connection using telnet on 9997 port telnet team-splunk01 9997.<BR /> After configure outputs.conf on the forwarders to send logs to Indexers (I usually use Deployment Server, but it's possible to do this also manually.<BR /> When outputs.conf is Ok to send logs to indexers (and Splunk restart) check if Indexers are receiving internal logs (index=_internal host=Universal_Forwarder_hostname).</P> <P>If it's OK I suggest to use Splunk_TA_Windows (eventually distributed by Deployment Server) to take Windows logs.</P> <P>Bye.<BR /> Giuseppe</P> Tue, 29 Sep 2020 15:59:19 GMT gcusello 2020-09-29T15:59:19Z https://community.splunk.com/t5/Getting-Data-In/Error-messages-when-I-try-to-connect-the-universal-forwarder/m-p/369506#M67067 <P>Hi, I'm brand new to Splunk and been given an existing Splunk environment to manage. I need to get a universal forwarder installed on a couple servers. This environment already has several universal forwarders in place. I installed the forwarders and selected Windows Application, Security and System logs. The deployment is setup to listen on port 9997. </P> <P>In the splunkd log on the forwarder server, I see these lines repeated and not sure what they mean. I'd appreciate any help and keep in mind, I'm still very new to this. Thanks!</P> <P>09-28-2017 18:45:47.694 -0400 INFO DC:DeploymentClient - channel=tenantService/handshake Will retry sending handshake message to DS; err=not_connected<BR /> 09-28-2017 18:45:59.695 -0400 INFO DC:DeploymentClient - channel=tenantService/handshake Will retry sending handshake message to DS; err=not_connected<BR /> 09-28-2017 18:46:02.913 -0400 WARN HttpPubSubConnection - HTTP client error in http pubsub Connection closed by peer uri=<A href="https://team-splunk01:9997/services/broker/connect/A917C286-95F0-4285-9F0C-8FDE5F9C5596/TEAM-SV-FILE01/c8a78efdd40f/windows-x64/8089/7.0.0/A917C286-95F0-4285-9F0C-8FDE5F9C5596/universal_forwarder/TEAM-SV-FILE01" target="_blank">https://team-splunk01:9997/services/broker/connect/A917C286-95F0-4285-9F0C-8FDE5F9C5596/TEAM-SV-FILE01/c8a78efdd40f/windows-x64/8089/7.0.0/A917C286-95F0-4285-9F0C-8FDE5F9C5596/universal_forwarder/TEAM-SV-FILE01</A><BR /> 09-28-2017 18:46:02.913 -0400 WARN HttpPubSubConnection - Unable to parse message from PubSubSvr: </P> Tue, 29 Sep 2020 16:03:12 GMT https://community.splunk.com/t5/Getting-Data-In/Error-messages-when-I-try-to-connect-the-universal-forwarder/m-p/369506#M67067 dougsummersett 2020-09-29T16:03:12Z https://community.splunk.com/t5/Getting-Data-In/Error-messages-when-I-try-to-connect-the-universal-forwarder/m-p/369507#M67068 <P>Hi dougsummersett,<BR /> the first messages means that the new UFs cannot connect to the Deployment Server.<BR /> You can test this using telnet on the management port (usually 8089).<BR /> Did you configured Deployment Server?<BR /> If not, message isn't important.<BR /> If yes and connection is OK, check if your UF is seen by the Deployment Server.</P> <P>When you say: "The deployment is setup to listen on port 9997." are you speaking of Indexer?</P> <P>To debug connection with Indexers, at first test connection using telnet on 9997 port telnet team-splunk01 9997.<BR /> After configure outputs.conf on the forwarders to send logs to Indexers (I usually use Deployment Server, but it's possible to do this also manually.<BR /> When outputs.conf is Ok to send logs to indexers (and Splunk restart) check if Indexers are receiving internal logs (index=_internal host=Universal_Forwarder_hostname).</P> <P>If it's OK I suggest to use Splunk_TA_Windows (eventually distributed by Deployment Server) to take Windows logs.</P> <P>Bye.<BR /> Giuseppe</P> Tue, 29 Sep 2020 15:59:19 GMT https://community.splunk.com/t5/Getting-Data-In/Error-messages-when-I-try-to-connect-the-universal-forwarder/m-p/369507#M67068 gcusello 2020-09-29T15:59:19Z