topic Re: Beginner issues in Installation

Beginner issues

pck1983 — Tue, 05 Sep 2023 22:59:38 GMT

Hello, I try to learn splunk and thatfor I have setup a demo-version in my home-lab on the Linux system...

Actually I have splunk running and I added the local files. Then I activated port 9997 and installed a universal forwarder on my Windows 10 PC.

I can see on Linux with tcpdump that I get packages on port 9997 but I can't get the data into splunk! When I try to add data from a forwarder manually then I see the message that I have actually not forwarders configured...

What am I doing wrong?

Re: Beginner issues

pck1983 — Wed, 06 Sep 2023 06:09:16 GMT

I forgot to tell you what my inputs.conf contains:

[WinEventLog://Application] disabled = 0 [WinEventLog://Security] disabled = 0 [WinEventLog://System] disabled = 0 [WinEventLog://Setup] disabled = 0

My outputs.conf:

[tcpout] defaultGroup = default-autolb-group [tcpout:default-autolb-group] server = 192.168.1.2:9997 [tcpout-server://192.168.1.2:9997]

Re: Beginner issues

bowesmana — Tue, 05 Sep 2023 23:40:00 GMT

Have you configured your forwarder firstly to collect data from the host and secondly where to send it?

https://docs.splunk.com/Documentation/Forwarder/9.1.0/Forwarder/Configuretheuniversalforwarder

https://docs.splunk.com/Documentation/Forwarder/9.1.0/Forwarder/Configureforwardingwithoutputs.conf#:~:text=conf-,The%20outputs.,require%20that%20you%20edit%20outputs.

Have you created an index that the UF will send its data to?

Re: Beginner issues

pck1983 — Wed, 06 Sep 2023 08:22:00 GMT

I have it solved - no idea what it was but after I rebooted all of the machines it start to work...

Thanks!

BTW - when my 60 days of test period are done and I go back to the free license. Will the forwarders work or do I need a prof. license?

I am pretty sure my 3 workstations will not exceed the 500MB / day limit!