Developing for Splunk Enterprise

Basic universal forwarder setup with splunk enterprise

fgoodwin
New Member

I am rolling out a trial instance of splunk enterprise, I have it running on a 2012r2 vm, and have installed the Universal Forwarder on two workstations pointing at it. My trouble is that I do not receive any data from the workstations. I have gone over the install/troubleshooting documentation several times but I feel like I'm missing something obvious, as the documentation seems to just assume that once you install the forwarder it should just work.

Do I need to make config changes on the server to support data input from the forwarder, or should they talk to eachother out of the box if the forwarder is pointed at the right IP?

Are there any youtube or other top to bottom no steps skipped idiot level tutorials I could follow through to find what I'm missing?

Thanks.

Tags (1)
0 Karma
1 Solution

FrankVl
Ultra Champion
  1. Do you have a splunktcp input configured on your Enterprise instance?
  2. Is the outputs.conf on your UF pointing to that Enterprise instance's IP and the port of that splunktcp input?
  3. Do you have any inputs configured on your UF? If so: which?
  4. Any errors / warnings in splunkd.log on any of your instances?

Also check out: http://docs.splunk.com/Documentation/Splunk/latest/Troubleshooting/Cantfinddata

View solution in original post

0 Karma

FrankVl
Ultra Champion
  1. Do you have a splunktcp input configured on your Enterprise instance?
  2. Is the outputs.conf on your UF pointing to that Enterprise instance's IP and the port of that splunktcp input?
  3. Do you have any inputs configured on your UF? If so: which?
  4. Any errors / warnings in splunkd.log on any of your instances?

Also check out: http://docs.splunk.com/Documentation/Splunk/latest/Troubleshooting/Cantfinddata

0 Karma

fgoodwin
New Member

I removed and re-added the 9997 receiver and reinstalled the universal forwarder on the client and it looks like its working this time. Thanks for the help.

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!