Deployment Architecture

forwarder data transfer not working

chirag3pillar
Explorer

I have set up an indexer and a forwwarder

On forwarder, the logs are -

12-20-2013 09:36:24.224 +0530 WARN TcpOutputFd - Connect to 192.168.1.40:9997 failed. No connection could be made because the target machine actively refused it.
12-20-2013 09:36:24.224 +0530 ERROR TcpOutputFd - Connection to host=192.168.1.40:9997 failed
12-20-2013 09:36:24.224 +0530 INFO TcpOutputProc - Detected connection to 192.168.1.40:9997 closed
12-20-2013 09:36:24.224 +0530 INFO TcpOutputProc - Will close stream to current indexer 192.168.1.40:9997
12-20-2013 09:36:24.224 +0530 INFO TcpOutputProc - Closing stream for idx=192.168.1.40:9997
12-20-2013 09:36:25.684 +0530 WARN TcpOutputFd - Connect to 192.168.1.40:9997 failed. No connection could be made because the target machine actively refused it.
12-20-2013 09:36:25.684 +0530 ERROR TcpOutputFd - Connection to host=192.168.1.40:9997 failed

12-20-2013 09:36:31.366 +0530 INFO TcpOutputProc - Connection to 192.168.1.40:9997 closed. Connection closed by server.

The indexer on the server is receiving data on 9997 (As the port is open) but there is no data transfer

Please let me know what i am doing wrong. I am a production 20 GB limit licensed user for Splunk

Thanks

Tags (1)
0 Karma

chirag3pillar
Explorer

solved it, thanks - index = main solved it

0 Karma

woodcock
Esteemed Legend

You should click Accept to close this question.

0 Karma

lukejadamec
Super Champion

It sounds like you may be having a problem with the connnectionhost config. See this answer for more details.

http://answers.splunk.com/answers/49833/splunk-forwarder-connection-refused-from-splunk-indexer

Basically, it says you should try adding this to your indexer:

    Etc/system/local/inputs.conf

    [splunktcp://9997] 
connection_host = none
0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...