Getting Data In

Active forwards: 10.20.30.40:9997 Configured but inactive forwards: None

rahul2gupta
Path Finder

Hi,

When I ran the command ./splunk list forward-server , we are getting below error message.

Active forwards:
10.20.30.40:9997
Configured but inactive forwards:
None

Can you please help me to troubleshoot the below error?

Regards,

Rahul Gupta

Labels (1)
0 Karma

isoutamo
SplunkTrust
SplunkTrust

What is your error? This said that you have configured one forwarder which are currently in use?

0 Karma

rahul2gupta
Path Finder

Hi @isoutamo ,

logs are not getting ingested into splunk.

Regards,

Rahul

 

0 Karma

isoutamo
SplunkTrust
SplunkTrust

Is that a correct address for your indexer?

Did you see internal logs from that forwarder or other FWDs?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...