topic Re: Splunk universal forwarder issues in windows in Getting Data In

Splunk universal forwarder issues in windows

Sravane — Mon, 11 Jan 2021 11:23:55 GMT

Hi All - I have installed SPlunk master in Linux and universal forwarder in Windows box.

And Also opened all Ports .Currently when i do Telnet server ip 9997 ,it is showing timeout in windows box.

In Splunk logs found following warning.Cooked connectioned timeout and some certificate issues.

Can you please provide rootcause or solution for this issue.

gcusello — Mon, 11 Jan 2021 12:03:14 GMT

let me understand:

you have Splunk Enterprise on a Linux server (Indexer),
you have a Universal Forwarder on Linux,
you're testing connection betweem Forwarder and Indexer using Telnet from Forwarder to Indexer and you fail;

is it correct?

If this is your situation, you have to check the following items:

Check the above items and then try again with telnet.

Ciao.

Giuseppe

Sravane — Mon, 11 Jan 2021 14:42:43 GMT

Hi Ciao -Let explain question

And connection between Splunk enterprise and forwarder is failing. We enabled ports aswell

gcusello — Mon, 11 Jan 2021 15:00:17 GMT

are you saying that:

you enabled receiving on Indexer on 9997 port [Settings -- Forwarding and Receiving -- receiving];
you disabled local firewall on Indexer (iptables);
you're sure that there isn't any Firewall between Forwarder and Indexer;
both the servers are in the same network segments.

Can you confirm?

If telnet from Forwarder to Indexer fails, probably one of the previous checks is wrong.

Ciao.

Giuseppe

Sravane — Mon, 11 Jan 2021 15:26:18 GMT

Hi -Please let me know how to disable firewall?

ANy commands to run?

Moreover,i tried telnet ip 9997 in universal forwared server and i got following error

"Configured but inactive forwards"

Thanks,

Sravan

Thanks,

Sravan

gcusello — Mon, 11 Jan 2021 15:33:11 GMT

it depends on the Linux version you're using, you can search it in Google.

Ciao.

Giuseppe