topic Re: Universal Forwarder will not activate in Feedback

Universal Forwarder will not activate

johnnyp74 — Tue, 03 Dec 2024 15:46:44 GMT

I have installed and configured my Universal forwarder, however while it starts it remains inactive:

Active forwards:
None

Configured but inactive forwards:
10.###.##.##:9997

I have validated that I am using the correct ip address, and that I can ping the indexer from the forwarder, and that port 9997 is not blocked. So at this point Im just not sure how to resolve this? Any assistance would be appreciated.

Thanks!

Re: Universal Forwarder will not activate

SanjayReddy — Tue, 03 Dec 2024 16:15:20 GMT

Hi @johnnyp74

have you restarted splunk service after updating outputs.conf

and as you mentioned you did ping to check connectivity

however have you did telent on port 9997 to indexer?

telnet <indexerip> 9997

in Splunkd.log have you seen any error messages, certainly splunkd.log messages help to troubleshoot further

Re: Universal Forwarder will not activate

khj — Fri, 18 Apr 2025 01:36:09 GMT

1. Make sure the UF is operating normally.
$SPLUNK_HOME/bin/splunk status
There should be no message other than the phrase is running.

2. Make sure that the log path you set in inputs.conf has a log

3. Make sure the inputs.conf settings are set correctly
If you set the index, the index must be created in the indexer.

4. Check the UI of the indexer to see if the data is in.
This method is more intuitive than checking with the inputs status of the cli.

5. Search index=_internal and search UF's IP to see if there are any problems

Karma if this has helped!

Re: Universal Forwarder will not activate

zksvc — Mon, 28 Apr 2025 08:44:46 GMT

Have you made sure port 9997 is enabled on Receive Data?

You can go to "Settings -> Forwarding And Receiving -> Receive data -> +Add new"