topic Re: Forwarding logs from server to local system in Installation

Forwarding logs from server to local system

vijay_n — Fri, 11 Feb 2022 04:22:11 GMT

Hi,

I have installed universal forwarder in a cloud instance(linux), then I installed splunk enterprise in my local machine(laptop) which is running win 10. I want to forward logs from linux machine to my laptop's splunk's indexer.

The problem is , what server IP should I be given in Linux universal forwarder/etc/system/local/outputs.conf

[tcpout:example]

server=?????

I tried giving my IP ***.***.**.*** :9997, but there is no use.

In my laptop, the splunk is running at localhost:8000.

Please help me with this.

Thanks.

Re: Forwarding logs from server to local system

VatsalJagani — Fri, 11 Feb 2022 05:14:24 GMT

You have to give the public IP of your laptop. And make sure the 9997 port of your laptop should be accessible publicly.

Though you are doing stuff on the public internet you have to take security measures like allowed IPs, SSL, etc.

Re: Forwarding logs from server to local system

vijay_n — Sat, 12 Feb 2022 20:29:54 GMT

HI, I tried adding the firewall rules by allowing tcp for 8000 and 9997, but it didn't helped.

Re: Forwarding logs from server to local system

PickleRick — Sat, 12 Feb 2022 22:18:12 GMT

Splunk server is like any other network service daemon. To connect forwarder to receiver (indexer) you need to have the network level visibility like with any other service (web server for example).

So if you can't do that on your own, get some local help with your network setup. There are so many different scenarios that we can't help you get a good advice without detailed knowledge of your networking environment.

Just remember that exposing your laptop services directly to open internet might not be the best idea unless you know really well what you're doing.

Re: Forwarding logs from server to local system

vijay_n — Sun, 13 Feb 2022 05:48:21 GMT

Thank you for the information.

Re: Forwarding logs from server to local system

VatsalJagani — Sun, 13 Feb 2022 06:56:50 GMT

Try checking with telnet to see if the network is okay or not.

Make sure you have enabled data receiving on the indexers.