All Apps and Add-ons

Unable to ping server message in streadfwd.log

goancea
Explorer

I am trying to use the Splunk for Stream setup (version="6.0.1) on a Universal forwarder.
CentOS 6.5, forwarder/Indexer Splunk release 6.0.2

After the splunk restart, I get the following. Then every 5 seconds I get the 'Unable to ping server' message in streamfwd.log

Found DataDirectory, Found UIDirectory, Loaded configuration file

2014-09-12 14:16:34 ERROR 140563220014848 stream.CaptureServer - Unable to ping server (Unable to establish connection to localhost: Connection refused): a116a931-dc21-49ad-a528-9532f9137826
streamfwd has started successfully (version 6.0.1 build 536)
stream.main - web interface listening on port 8889

Could I be setting the path incorrectly to localhost? I get another error of the same sort when I try and setup the add new

wire data input: (nsg03 is the forwarder server)
SplunkApp for Stream location (I am confused about this entry)

I use the example, except the host name entry for the forwarder
Upon 'Save'

Encountered the following error while trying to save: In handler 'streamfwd': Unable to ping server (Unable to establish connection to name of server: Connection refused): 4a7c6744-f1d1-4752-827b-6314172e7227
At present, I am not seeing how to resolve this error. Anyone else have this issue, and what was your solution?

Tags (1)
0 Karma
1 Solution

csharp_splunk
Splunk Employee
Splunk Employee

On a Forwarder, you need to set in inputs.conf:

[streamfwd://streamfwd]
splunk_stream_app_location = http://<stream_search_head:port>/en-us/custom/splunk_app_stream/
disabled = 0

Can you pastebin or reply with your inputs.conf on your Forwarder?

View solution in original post

goancea
Explorer

I followed your suggestion, and used the :8000 and it worked.

I was confused with the examples showing localhost, so I used that and then the forwarder server name.
Of course, that didn't work.

Thanks for the guidance.

0 Karma

csharp_splunk
Splunk Employee
Splunk Employee

On a Forwarder, you need to set in inputs.conf:

[streamfwd://streamfwd]
splunk_stream_app_location = http://<stream_search_head:port>/en-us/custom/splunk_app_stream/
disabled = 0

Can you pastebin or reply with your inputs.conf on your Forwarder?

goancea
Explorer

part of my comment cut off, used the indexer name and port 8000.
That did the trick.

0 Karma

tred23
Path Finder

It worked once I added the indexer name and port 8000 just like goancea did.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...