topic Re: Configured but inactive forwards in Getting Data In

Configured but inactive forwards

julian0125 — Mon, 08 Jul 2019 23:19:43 GMT

Hello Splunkers!

i'm in doubt, i have installed UF on windows server but when i list forward-server it says that there are no active fordware but is configurated, on port 9997 and also de deploy with 8088. What issue do you think it is? is there a way to active the forwarder?

Thanks

Re: Configured but inactive forwards

ddrillic — Tue, 09 Jul 2019 00:16:53 GMT

Yup - you need to start it, probably as a service.

Re: Configured but inactive forwards

natalienguyen — Tue, 09 Jul 2019 02:26:51 GMT

Did you restart your splunkforwarder service after the configuration?

Re: Configured but inactive forwards

gcusello — Tue, 09 Jul 2019 06:27:14 GMT

Hi julian0125,
did you checked if the connection ports are open? you can check them using telnet.
then, you can check in forwarder's logs ($SPLUNK_HOME/var/log/splunk/) if the connection is established.
At least check if the forwarder is active, you can check the process (ps -eafd) searching for splunkd process.
If you find that the process is active and ports are open, check if the servername is correct ($SPLUNK_HOME/etc/system/local/server.conf e $SPLUNK_HOME/etc/system/local/inputs.conf).

You can see at https://docs.splunk.com/Documentation/Forwarder/7.3.0/Forwarder/Troubleshoottheuniversalforwarder or https://docs.splunk.com/Documentation/Splunk/7.3.0/Forwarding/Receiverconnection

Bye.
Giuseppe