https://community.splunk.com/t5/Getting-Data-In/Direct-syslog-forwarding-from-Isilon-to-Splunk/m-p/546434#M91014 <P>I am trying to setup syslog forwarding from Isilon Cluster to Splunk server ... I have done the following steps as per instructions online.</P><P>1. edit syslog.conf file in cluster<BR />2. create a read only user in splunk<BR />3. Deploy the DELL EMC app and TA on deployment server.</P><P>Currently I can see that all of the cluster nodes are talking to my server but all TCP state for the nodes are in TIME_WAIT. I am also unable to detect any connection with the cluster from the Splunk UI. I tried setting up the TA with the read only user I had created. But that is also throwing "authentication" error.</P><P>I am new to Splunk and am no expert.<BR />I am unable to understand what I have missed. Requesting help from the Splunk community.</P> Thu, 01 Apr 2021 20:45:02 GMT Arnab6641 2021-04-01T20:45:02Z https://community.splunk.com/t5/Getting-Data-In/Direct-syslog-forwarding-from-Isilon-to-Splunk/m-p/546434#M91014 <P>I am trying to setup syslog forwarding from Isilon Cluster to Splunk server ... I have done the following steps as per instructions online.</P><P>1. edit syslog.conf file in cluster<BR />2. create a read only user in splunk<BR />3. Deploy the DELL EMC app and TA on deployment server.</P><P>Currently I can see that all of the cluster nodes are talking to my server but all TCP state for the nodes are in TIME_WAIT. I am also unable to detect any connection with the cluster from the Splunk UI. I tried setting up the TA with the read only user I had created. But that is also throwing "authentication" error.</P><P>I am new to Splunk and am no expert.<BR />I am unable to understand what I have missed. Requesting help from the Splunk community.</P> Thu, 01 Apr 2021 20:45:02 GMT https://community.splunk.com/t5/Getting-Data-In/Direct-syslog-forwarding-from-Isilon-to-Splunk/m-p/546434#M91014 Arnab6641 2021-04-01T20:45:02Z