All Apps and Add-ons

Pi-hole DNS App for Splunk: Why are we getting error "no route to host" when sending logs from pi-hole to Splunk with a UF?

Path Finder

I am attempting to send DNS logs from pi-hole to Splunk, I have the Universal forwarder installed on the Pihole and when I attempt to start Splunk on the UF I get the following error.
I confirmed that the Splunk host is listening on TCP 5353 for that connection and can ping the host from the pi-hole.
Any ideas on what I am missing?

05-29-2019 12:40:42.231 -0400 WARN  TcpOutputFd - Connect to failed. No route to host
05-29-2019 12:40:42.231 -0400 ERROR TcpOutputFd - Connection to host= failed
05-29-2019 12:40:42.232 -0400 WARN  TcpOutputFd - Connect to failed. No route to host
05-29-2019 12:40:42.232 -0400 ERROR TcpOutputFd - Connection to host= failed

root@raspberrypi:/opt/splunkforwarder/etc/system/local# ping
PING ( 56(84) bytes of data.
64 bytes from icmp_seq=1 ttl=64 time=0.564 ms
64 bytes from icmp_seq=2 ttl=64 time=0.530 ms
64 bytes from icmp_seq=3 ttl=64 time=0.532 ms

alt text

Here are the config files on my pi-hole:


root@raspberrypi:/opt/splunkforwarder/etc/system/local# cat inputs.conf 
host = raspberrypi
index = pihole
sourcetype = dnsmasq
disabled = false


root@raspberrypi:/opt/splunkforwarder/etc/system/local# cat outputs.conf 
defaultGroup = default-autolb-group

server =



root@raspberrypi:/opt/splunkforwarder/etc/system/local# cat props.conf 
TIME_FORMAT = %b %d %H:%M:%S
0 Karma

Path Finder

It was the host based FW blocking the connection.

Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...