topic Re: Why are there no logs received when the universal forwarder is sending data to a search head? in Getting Data In

Why are there no logs received when the universal forwarder is sending data to a search head?

aalaa — Thu, 25 Apr 2019 10:25:43 GMT

hello, i have a problem with the universal forwarder, i set up a universal forwarder to send to a search head splunk but i have not received any log

Re: Why are there no logs received when the universal forwarder is sending data to a search head?

vishaltaneja070 — Thu, 25 Apr 2019 10:30:29 GMT

@aalaa,

Didn't get you. As UF is used to send data to Indexer not SF.
And also can you share the inputs.conf and outputs.conf file on UF.

Re: Why are there no logs received when the universal forwarder is sending data to a search head?

aalaa — Thu, 25 Apr 2019 10:37:30 GMT

no log also at the indexer

Re: Why are there no logs received when the universal forwarder is sending data to a search head?

vishaltaneja070 — Thu, 25 Apr 2019 10:38:56 GMT

Can you please share inputs.conf and outputs.conf on forwarder?

Re: Why are there no logs received when the universal forwarder is sending data to a search head?

aalaa — Thu, 25 Apr 2019 11:06:33 GMT

sorry i can't , it's confidentiel !
but can you tell me what i should do ?

Re: Why are there no logs received when the universal forwarder is sending data to a search head?

vishaltaneja070 — Thu, 25 Apr 2019 11:08:39 GMT

you can hide the confidential data and put the screenshot which can help to understand if the configuration is correct.

Re: Why are there no logs received when the universal forwarder is sending data to a search head?

FrankVl — Thu, 25 Apr 2019 12:02:06 GMT

What you need to do is some properly structured troubleshooting. If you want help with that, the only way to get that is by sharing the relevant configurations (masking confidential info where needed) and providing a lot more info on what your setup looks like.

Also take a look at the troubleshooting guide: https://docs.splunk.com/Documentation/Splunk/latest/Troubleshooting/Cantfinddata

Just saying "it doesn't work", "what should I do" makes it very difficult for anyone to help. Functioning crystal balls are still very rare 😉

Re: Why are there no logs received when the universal forwarder is sending data to a search head?

aalaa — Thu, 25 Apr 2019 12:06:35 GMT

output.conf :
[tcpout]
defaultGroup = default-autolb-group

[tcpout:default-autolb-group]
server = ..**.*:9997

[tcpout-server://..***:9997]

Re: Why are there no logs received when the universal forwarder is sending data to a search head?

aalaa — Thu, 25 Apr 2019 12:07:20 GMT

inputs.conf:
[default]
host = mdelta

Re: Why are there no logs received when the universal forwarder is sending data to a search head?

aalaa — Thu, 25 Apr 2019 12:21:32 GMT

@vishaltaneja07011993

Re: Why are there no logs received when the universal forwarder is sending data to a search head?

splunk_sv — Thu, 25 Apr 2019 12:39:58 GMT

If you are not able to see any logs on the Splunk search head, the possible issue can be,

Splunk indexer is not enabled to listen to the forwarding port.
The Splunk forwarder is not able to talk with the Splunk indexer.

Firstly, If you have followed every step to set up a forwarder then probably you would have completed the first step.

Secondly, you need to check the forward-server status of your Splunk forwarder using the below-given command,

splunk list forward-server

It will show the list of forward-servers configured and they will be categorized under two categories "Active forwards" and "Configured but inactive forwards".
If your forward-server is listed under the latter then, you should check your Splunk forwarder's logs to find out the particular reason.

Note:
- The log file is stored under /var/log/splunk/splunkd.log

If you see any error you can post it here, so that we can help you with that too.

You can find more information related to universal forwarder setup at the below link,
https://docs.splunk.com/Documentation/Forwarder/7.2.6/Forwarder/Configuretheuniversalforwarder

Hope it helps.

Re: Why are there no logs received when the universal forwarder is sending data to a search head?

aalaa — Thu, 25 Apr 2019 12:47:36 GMT

thank you for your response !
my forward server is listed under "Active forwards" but no log

Re: Why are there no logs received when the universal forwarder is sending data to a search head?

vishaltaneja070 — Thu, 25 Apr 2019 13:34:28 GMT

could you please give output of

splunk display listen

on indexer

Re: Why are there no logs received when the universal forwarder is sending data to a search head?

vishaltaneja070 — Thu, 25 Apr 2019 13:34:43 GMT

check if it is pointing to 9997.

Re: Why are there no logs received when the universal forwarder is sending data to a search head?

splunk_sv — Fri, 26 Apr 2019 07:47:23 GMT

Check your log file /var/log/splunk/splunkd.log
Does it show any errors?

Re: Why are there no logs received when the universal forwarder is sending data to a search head?

splunk_sv — Sat, 27 Apr 2019 17:13:19 GMT

Is your issue fixed?

Re: Why are there no logs received when the universal forwarder is sending data to a search head?

woodcock — Sun, 28 Apr 2019 03:50:19 GMT

Try these links:

https://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Receiverconnection
https://docs.splunk.com/Documentation/Splunk/latest/Security/Troubleshootyouforwardertoindexerauthentication
https://wiki.splunk.com/Community:Troubleshooting_Monitor_Inputs