I'm struggling to get Exchange Universal Forwarders to connect to the central instance.
This is the error in the splunkd log;
10-26-2013 16:39:13.343 +0100 WARN TcpOutputFd - Connect to 192.168.x.x:9997 failed. No connection could be made because the target machine actively refused it.
So trying a portqry on that port on that server and this is the response
Name resolved to 192.168.x.x
querying...
TCP port 9997 (unknown service): NOT LISTENING
Firewall on the central server is off and so not sure what the issue is here.
Checking the Splunk services on the central server show the splunkd service running on 8089 and the web service running on 8000.
Am I missing a service or should I be pointing to 8089?
This is a new central server install on Server 2012 R2, Splunk V6. Exchange is 2010 and installed SP2 just for Splunk.
Log into your indexer. If you are using 6.0 then click settings in the upper right hand corner, then forwarding and receiving. Under receive data click on configure receiving. Then add new, type 9997 - save.
how about if we are still using 5.0.6? How is this fixed?
Same steps.
Log into your indexer. If you are using 6.0 then click settings in the upper right hand corner, then forwarding and receiving. Under receive data click on configure receiving. Then add new, type 9997 - save.
Hello
Excellent, this has fixed.
Thanks
Russell
Did this help or is that not the problem?