Splunk_TA_windows / Universal Forwarder phoning home, not sending data?

[semenko]

I'm new to Splunk, and trying it out in a small environment of Windows 8 machines.

• I have a Splunk frontend (collector?) running on Ubuntu, with a few Windows 8 clients.
• I've deployed the Universal Forwarder via GPO to Windows 8 test machines
• I installed the Splunk for Windows app on the Ubuntu collector (I see a cool Windows GUI on the :8000 interface now)
• I've put the Splunk_TA_Windows app into the deplyoment_apps folder, and assigned it to the clients

Now the UI shows the apps are deployed (in the Forwarder Management panel), and clients are "Phoning Home" (cool!). However, I don't see any data being collected.

When I click on the "App: Windows" area in the :8000 gui, I don't see any events. Zero hosts, zero log names, etc.

Any thoughts on how to debug this?

[semenko]

Ok, I think this ended up being a problem with Linux vs Windows line returns (e.g. adding ^M to the output.conf file on Linux before deployment).

Manually editing the output.conf file on a Windows machine (or adding ^M to line returns) solved this issue.

However, I can't seem to get splunk to re-deploy the new output.conf with ^M returns.

Q: How can I tell Splunk to re-deploy output.conf to the UniversalForwarders?

I've edited output.conf appropriately, and ran /opt/splunk/bin/splunk reload deploy-server

The clients are "phoning home" to the deployment server, but they don't have the correct output.conf that I see in deployment-apps/Splunk_TA_windows/default/

[semenko]

I added a 9997 receiver. I think the forwarders are sending to that port (I set the MSI option of DEPLOYMENT_SERVER and RECEIVING_INDEXER, so I think it should know where the server is).

How can I set the forwarders to forward from the Windows Event Log?

[I figured the Splunk_TA_windows application would forward data, as I copied the default example into the deplyoment_apps\Splunk_TA_windows\local\inputs.conf ]

[antlefebvre]

And when you deployed the forwarders did you set them to forward from your windows event log?

[antlefebvre]

Have you configured under settings -> forwarding and receiving ->receive data any listening ports? 9997 is the default. You would also want to make sure your universal forwarders are sending to that port.