topic Unable to Receive Data from universal forwarder to splunk server in Getting Data In

Unable to Receive Data from universal forwarder to splunk server

AmyShah — Fri, 04 Jun 2021 16:44:47 GMT

Dear All,

I have recently deployed Universal forwarder on Ubuntu and and the server on other Linux machine. I am unable to receive data from the forwarder at all. I am unable to fetch any data when I click Data Summery on the Splunk interface.

Re: Unable to Receive Data from universal forwarder to splunk server

richgalloway — Fri, 04 Jun 2021 17:56:41 GMT

Did you enable receiving on the Linux machine's port 9997?

Did you configure the UF to send data to the Linux machine? Did you configure any inputs on the UF? Have you checked the UF's splunkd.log?

Re: Unable to Receive Data from universal forwarder to splunk server

isoutamo — Fri, 04 Jun 2021 19:53:28 GMT

Check also splunk server firewall and selinux configuration.

Re: Unable to Receive Data from universal forwarder to splunk server

ephemeric — Mon, 23 Aug 2021 15:12:53 GMT

Check your logs on the SUF and the receiver/indexer. Easiest place to start. Is the SUF connecting and forwarding in the log? Are you receiving and indexing in the log?

From the SUF to receiver in `var/log/splunk/splunkd.log`:

08-23-2021 15:02:18.711 +0000 INFO AutoLoadBalancedConnectionStrategy [1037 TcpOutEloop] - Found currently active indexer. Connected to idx=10.10.50.206:9997, reuse=1.

On the receiver in `var/log/splunk/metrics.log`:

08-23-2021 15:04:16.198 +0000 INFO Metrics - group=tcpin_connections, 10.10.50.209:37444:9997, connectionType=cooked, sourcePort=37444, sourceHost=10.10.50.209, sourceIp=10.10.50.209, destPort=9997, kb=15.651, _tcp_Bps=517.002, _tcp_KBps=0.505, _tcp_avg_thruput=12.605, _tcp_Kprocessed=41409.860, _tcp_eps=0.323, _process_time_ms=0, evt_misc_kBps=0.000, evt_raw_kBps=0.452, evt_fields_kBps=0.032, evt_fn_kBps=0.000, evt_fv_kBps=0.000, evt_fn_str_kBps=0.000, evt_fn_meta_dyn_kBps=0.000, evt_fn_meta_predef_kBps=0.000, evt_fn_meta_str_kBps=0.000, evt_fv_num_kBps=0.000, evt_fv_str_kBps=0.000, evt_fv_predef_kBps=0.000, evt_fv_offlen_kBps=0.000, evt_fv_fp_kBps=0.000, build=ddff1c41e5cf, version=8.2.1, os=Linux, arch=x86_64, hostname=spl-suf-01.ephemeric.lan, guid=752B1D7C-B3C5-43D3-A779-EB6C0FCAA965, fwdType=uf, ssl=false, lastIndexer=10.10.50.206:9997, ack=false

On the SUF:

ncat -v spl-idx-01.ephemeric.lan 9997 Ncat: Version 7.50 ( https://nmap.org/ncat ) Ncat: Connected to 10.10.50.206:9997.

Metrics on the SUF:

08-23-2021 15:12:21.012 +0000 INFO Metrics - group=tcpout_connections, name=default-autolb-group:10.10.50.206:9997:0, sourcePort=8089, destIp=10.10.50.206, destPort=9997, _tcp_Bps=526.97, _tcp_KBps=0.51, _tcp_avg_thruput=11.06, _tcp_Kprocessed=41656, _tcp_eps=0.33, kb=15.44

Re: Unable to Receive Data from universal forwarder to splunk server

mykol_j — Thu, 21 Mar 2024 16:01:04 GMT

did you ever get resolution on this?

My deployment server stopped servicing clients -- start throwing this error. No firewall or selinux issues as suggested below...