All Apps and Add-ons

Pi-hole DNS App for Splunk: Why are we getting error "no route to host" when sending logs from pi-hole to Splunk with a UF?

Path Finder

I am attempting to send DNS logs from pi-hole to Splunk, I have the Universal forwarder installed on the Pihole and when I attempt to start Splunk on the UF I get the following error.
I confirmed that the Splunk host is listening on TCP 5353 for that connection and can ping the host from the pi-hole.
Any ideas on what I am missing?

05-29-2019 12:40:42.231 -0400 WARN  TcpOutputFd - Connect to failed. No route to host
05-29-2019 12:40:42.231 -0400 ERROR TcpOutputFd - Connection to host= failed
05-29-2019 12:40:42.232 -0400 WARN  TcpOutputFd - Connect to failed. No route to host
05-29-2019 12:40:42.232 -0400 ERROR TcpOutputFd - Connection to host= failed

root@raspberrypi:/opt/splunkforwarder/etc/system/local# ping
PING ( 56(84) bytes of data.
64 bytes from icmp_seq=1 ttl=64 time=0.564 ms
64 bytes from icmp_seq=2 ttl=64 time=0.530 ms
64 bytes from icmp_seq=3 ttl=64 time=0.532 ms

alt text

Here are the config files on my pi-hole:


root@raspberrypi:/opt/splunkforwarder/etc/system/local# cat inputs.conf 
host = raspberrypi
index = pihole
sourcetype = dnsmasq
disabled = false


root@raspberrypi:/opt/splunkforwarder/etc/system/local# cat outputs.conf 
defaultGroup = default-autolb-group

server =



root@raspberrypi:/opt/splunkforwarder/etc/system/local# cat props.conf 
TIME_FORMAT = %b %d %H:%M:%S
0 Karma

Path Finder

It was the host based FW blocking the connection.