Getting Data In

A splunktcp forwarder port is not configured in inputs.conf



I installed a heavy-forwarder, and will be monitoring some logfiles. I configured the inputs/outputs/props conf file and I restarted the forwarder, and it keeps telling me that "A splunktcp forwarder port is not configured in inputs.conf". I'm not looking to monitor any ports - why is it telling me that?

Tags (1)


I see the same issue too. Is it something particular to Splunk 5?

0 Karma


I'm seeing the same message in my Universal Forwarder's log files as well.
This forwarder is only supposed to be reading local log files - not receiving events from any ports.

For now I'm ignoring the message.. but I'm still curious as to why it is showing up.

0 Karma

Ultra Champion

splunktcp is used by your receivers (indexers) that your forwarder is sending data to.
In your forwarder's outputs.conf , is the receiver host that you have specified correctly setup and listening on the splunktcp port ?

Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!