topic Re: Question 1: Splunk Forwarder - configured inputs.conf in Getting Data In

Question 1: Splunk Forwarder - configured inputs.conf

ghannemann — Wed, 27 Feb 2013 01:30:13 GMT

I have a standalone Splunk Server.
I have setup the server to revieve data from universal forwarder on a particular port.
I have setup an input on the server (index and web) in etc/system/local/inputs.conf staring with
[splunktcp...

One forwarder now appears to be sending logs after much fiddling around getting it to work.
The second forwarder is now doing what the first one did. It returns the following message in the logs:

CMConfig - A splunktcp forwarder port is not configured in inputs.conf

Which input file is this message refereing to? Forwarder or Server?

As far as I can tell the inputs.conf is serup.
What should I be looking at to solve this?
Does it need a port per connection?

We are running the latest version of splunk

Thank in advance.

Re: Question 1: Splunk Forwarder - configured inputs.conf

yannK — Wed, 27 Feb 2013 07:00:11 GMT

the forwarder must be missing a configured outputs.conf, please edit to add the definition (use the other one as model) or use the CLI commands to define the forwarding.

Re: Question 1: Splunk Forwarder - configured inputs.conf

ghannemann — Tue, 12 Mar 2013 00:17:52 GMT

This seems to almost a false message.
The ouputs.conf are configured - correct according to what I can find in the documentation.
The message appears nearly everytime when the forwarder is started. It then appears to reconnect and then it works. If can see the via netstat that an initial connection has a status for TIME_WAIT, and a second connection shows ESTABLISHED. The forwarder then appears to work.

Re: Question 1: Splunk Forwarder - configured inputs.conf

ghannemann — Fri, 28 Aug 2015 02:05:53 GMT

Long time ago - was a network issue