Getting Data In

10-26-2013 16:39:13.343 +0100 WARN TcpOutputFd - Connect to 192.168.x.x:9997 failed. No connection could be made because the target machine actively refused it.

russellrobertso
Engager

I'm struggling to get Exchange Universal Forwarders to connect to the central instance.

This is the error in the splunkd log;

10-26-2013 16:39:13.343 +0100 WARN TcpOutputFd - Connect to 192.168.x.x:9997 failed. No connection could be made because the target machine actively refused it.

So trying a portqry on that port on that server and this is the response

Name resolved to 192.168.x.x

querying...

TCP port 9997 (unknown service): NOT LISTENING

Firewall on the central server is off and so not sure what the issue is here.

Checking the Splunk services on the central server show the splunkd service running on 8089 and the web service running on 8000.

Am I missing a service or should I be pointing to 8089?

This is a new central server install on Server 2012 R2, Splunk V6. Exchange is 2010 and installed SP2 just for Splunk.

0 Karma
1 Solution

ShaneNewman
Motivator

Log into your indexer. If you are using 6.0 then click settings in the upper right hand corner, then forwarding and receiving. Under receive data click on configure receiving. Then add new, type 9997 - save.

View solution in original post

kcooper
Communicator

how about if we are still using 5.0.6? How is this fixed?

somesoni2
SplunkTrust
SplunkTrust

Same steps.

ShaneNewman
Motivator

Log into your indexer. If you are using 6.0 then click settings in the upper right hand corner, then forwarding and receiving. Under receive data click on configure receiving. Then add new, type 9997 - save.

russellrobertso
Engager

Hello

Excellent, this has fixed.

Thanks

Russell

0 Karma

ShaneNewman
Motivator

Did this help or is that not the problem?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...