topic Re: I've setup a forwarder on Windows. My receiver is enabled and running tcpdump shows connection. However, Splunk is not indexing data. in Getting Data In

I've setup a forwarder on Windows. My receiver is enabled and running tcpdump shows connection. However, Splunk is not indexing data.

bigfatyeastroll — Wed, 25 Mar 2020 14:04:00 GMT

one of my team has installed the forwarder on a Windows client. running tcpdump on the backend of splunk enterprise shows:

08:32:06.990056 IP xxx.56097 > splunk.xxx.9997: Flags [P.], seq 777:895, ack 1, win 512, length 118
08:32:06.990080 IP splunk.xxx.9997 >xxx.56097: Flags [.], ack 895, win 2512, length 0

my receiver is enabled on port 9997 but Splunk is not indexing the data. I have other clients using the same setup and they are being indexed.

Thoughts/Suggestions?

Re: I've setup a forwarder on Windows. My receiver is enabled and running tcpdump shows connection. However, Splunk is not indexing data.

bigfatyeastroll — Wed, 25 Mar 2020 14:21:57 GMT

Could it be something in the setup during the installation of the Forwarder?

Re: I've setup a forwarder on Windows. My receiver is enabled and running tcpdump shows connection. However, Splunk is not indexing data.

richgalloway — Wed, 25 Mar 2020 14:23:15 GMT

Verify the forwarder has inputs enabled and that those inputs reference indexes that exist.

Re: I've setup a forwarder on Windows. My receiver is enabled and running tcpdump shows connection. However, Splunk is not indexing data.

bigfatyeastroll — Wed, 25 Mar 2020 18:13:09 GMT

The forwarder was not setup using the Domain Admin and using the Domain\Username style. Thank!