All Apps and Add-ons

Why is no data being indexed after installing Splunk, universal forwarder and 3 applications?

adamswebsiteacc
New Member

Hey All,
I am very new to Splunk. I have installed my first Splunk server/index/deployment server on a single server and have also just installed the following applications:

Windows Infrastructure,

Splunk LDAP Support and

Splunk_TA_windows

As per the manual I configured and copied the relevant apps to my deployment-apps folder being:

SA-ModularInput-PowerShell,

Splunk_TA_windows,

TA-DNSServer-NT6 and

TA-DomainController-2012R2 as per my environment.

Having installed the universal forwarder on my first DC (Server 2012 r2) it has received the apps using the deployment server as expected. Looking at the splunk and metrics log on my forwarder I can see I am connected to the splunk server on 9997 and events are listed in metrics.log however my indexer shows that all non-internal indexes are empty. Looking at the metrics log on the indexer I can see this log has already rolled a number of times and shows events from DC.

I have checked the inputs.conf in Splunk_TA_windows and confirmed the items I am interested in are enabled as a starting point. Any suggestions on what I should be looking at next?

0 Karma

NaorP
Explorer

If you are using a Splunk heavy forwarder and not a single box make sure that you enabled Receiving of data onto your splunk indexer.
head to Settings -> Forwarding and receiving -> Configure receiving -> New -> Than add 9997.

If you are using a single box installation that connects directly to the DC server than head to Settings -> Data inputs -> and make sure you are listening to the data flow from the universal forwarder.

0 Karma

NaorP
Explorer

Hi,
I understand but what is still not clear to me is what exactly is your architecture. IF you are using a single box deployment (as you suggested with search head+indexer+deployment server) than port 9997 is not for you (it is used only in cases of a splunk heavy forwarder transferring data to the splunk indexer).
You will need to add an input for Windows Event Log collection.
Go to Settings -> Data inputs -> Add Data -> Windows Event Log Collection.

Best regards,
Naor

0 Karma

adamswebsiteacc
New Member

Thanks for the response however as mentioned in my initial question I can see the connection on 9997 and the port is configured and listening. I used the Settings -> Forwarding and Receiving -> Configure Receiving -> New -> TCP 9997

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...