topic Re: please help me : How CAN I configurate splunk enterprise so it could see the forwarder ? in Getting Data In

please help me : How CAN I configurate splunk enterprise so it could see the forwarder ?

neermine — Sat, 11 Aug 2018 15:50:02 GMT

hey please help!! i did all the steps of universal forwarder configuration but i still can't forward data into splunk entreprise
How CAN I configurate splunk enterprise so it could see the forwarder ??

Re: please help me : How CAN I configurate splunk enterprise so it could see the forwarder ?

dauren_akilbeko — Sat, 11 Aug 2018 15:56:22 GMT

Did you enable receiving of data from forwarders? Check if your Splunk Enterprise instance is listening at localhost:8000/fr-FR/manager/launcher/data/inputs/tcp/cooked

Re: please help me : How CAN I configurate splunk enterprise so it could see the forwarder ?

neermine — Sat, 11 Aug 2018 16:19:04 GMT

i did enable receiving of data from forwaders but splunk enterprise id not listening at localhost:8000 his etat is :wait-time what can i do ?

Re: please help me : How CAN I configurate splunk enterprise so it could see the forwarder ?

dauren_akilbeko — Sat, 11 Aug 2018 16:23:29 GMT

By default Splunk listens for data from forwarders on port 9997, but you have to enable it. http://i.imgur.com/pUgpVoX.png

8000 is for web access.

Re: please help me : How CAN I configurate splunk enterprise so it could see the forwarder ?

skoelpin — Sat, 11 Aug 2018 17:12:25 GMT

So you've confirmed your indexer is listening to the forwarder on port 9997. Next you have to confirm if you placed an outputs.conf on the forwarder which tells the forwarder where to send the logs to. Next you should place an inputs.conf on the forwarder which tell it which directory/file(s) to monitor and forwarder to Splunk. Once you add these files to the forwarder, you should then restart the Splunk service on the forwarder and do a search to verify the logs are going to Splunk.

http://docs.splunk.com/Documentation/Forwarder/7.1.2/Forwarder/Configureforwardingwithoutputs.conf
http://docs.splunk.com/Documentation/Splunk/7.1.2/Data/Monitorfilesanddirectorieswithinputs.conf

Re: please help me : How CAN I configurate splunk enterprise so it could see the forwarder ?

neermine — Mon, 13 Aug 2018 10:13:27 GMT

i did all the steps that you did mention but it still does not work 😕
i install the splunk entreprise on a windows 7 machine and the forwarder on another windows 7 but in the same virtuelle machine and the two system have the same ip adresse could this be the problem ?

Re: please help me : How CAN I configurate splunk enterprise so it could see the forwarder ?

neermine — Mon, 13 Aug 2018 10:14:36 GMT

it's active

Re: please help me : How CAN I configurate splunk enterprise so it could see the forwarder ?

neermine — Mon, 13 Aug 2018 10:27:10 GMT

the firewall is desactivate also

Re: please help me : How CAN I configurate splunk enterprise so it could see the forwarder ?

skoelpin — Mon, 13 Aug 2018 14:07:26 GMT

Did you restart the forwarder service after applying the configs? Can you do a telnet from the forwarder to the indexer to confirm you can connect. Is your indexer listening on port 9997 for active connections?

Re: please help me : How CAN I configurate splunk enterprise so it could see the forwarder ?

neermine — Wed, 15 Aug 2018 13:28:45 GMT

it was a problem of network because the tow machines where the forwarder and the splunk were set up now i can see my machine name in the host list of splunk but i can't find the index and the sourcetype that i have create in the inputs.conf
thanks.

Re: please help me : How CAN I configurate splunk enterprise so it could see the forwarder ?

skoelpin — Wed, 15 Aug 2018 13:32:48 GMT

What index did you specify in your inputs.conf? You can do a quick search over the tsidx files to locate your logs

| metasearch index=*

Re: please help me : How CAN I configurate splunk enterprise so it could see the forwarder ?

neermine — Wed, 15 Aug 2018 13:41:18 GMT

this is my inputs :
[monitor://C:\var\log*.log]
disabled = 0
sourcetype = log
index = me
metasearch index=* didn't work
my os is wondows