Archive

Configuring forwarder and receiver

Explorer

Hi There,

I'm very new to splunk and trying to do a POC on my laptop. I installed windows version of splunk and installed the splunk. I'm trying to configure the forwader and receiver to search the event logs on laptop.

For receivers I configured it via splunk web

Manager >> Forwarding and receiving >> Configuring receiving and gave the port as 9997


For forwaders
Following files were modified
$SPLUNK_HOME\etc\apps\SplunkLightForwarder\default\inputs.conf

Copy paste mistake, my inputs.conf file has the following info.

[monitor://C:\\Windows\\System32\\winevt\\Logs\\*.*]
_TCP_ROUTING = my_indexers

$SPLUNK_HOME\etc\system\local\outputs.conf

[tcpout]
defaultGroup=my_indexers

[tcpout:my_indexers]
compressed=false
server=localhost:9997

After above changes I restarted the splunkd and splunk web and tried the following in the search

index = my_indexers

which is returning nothing......

Did I miss any configurations? do I need to install any windows app for forwarders please advise, thank you very much.

Tags (1)

Explorer

This worked and it took a while to load the data. Thanks gkanapathy for your assistance.

0 Karma

Splunk Employee
Splunk Employee

The audit is an index that gets created automatically and it is used internally by splunk.
Try putting the the stanza in your $SPLUNK
HOME/etc/system/local/inputs.conf:
[monitor://C:Windows/System32/winevt/Logs/]
index = main
disabled = false
This should bring in all data under Logs dir. Don't forget to do a restart of splunk.
Technically speaking, you dont need to forward local data to the localhost (like you're doing with outputs.conf) - your indexer instance can read/monitor files just fine 🙂

0 Karma

Splunk Employee
Splunk Employee

It seems like you're routing the data using the inputs.conf and then trying to search data on the wrong and probably non-existing index? It seems like myindexers is your tcpout group name.
Give this a try and comment let us know whether it works:
- remove "
TCPROUTING = myindexers" from your inputs file
- put this instead: "index = main" or whatever index you want the data to go to.

Explorer

thanks for responding....

This is what I did per you suggestions

[monitor://C:\Windows\System32\winevt\Logs*.*]

index = main

and trying to search index = main and still fails.
To give the complete picture I installed indexer, forwarder and receiver on the same machine i.e. my laptop and trying to forward event logs to the receiver and index it and ready for search and I'm failing there.
but if I search like index="_audit" spluk is returning the results. I did not create that index.

0 Karma