After upgrade Splunk Universal Forwarder is not sending logs to Indexer tier

[riqbal47010]

After upgrading universal fowarder from 7.1.2 to 7.3.1, the universal forwardre stop sending logs to splunk.

[riqbal47010 · Accepted solution]

Hi
Although it was not the TLS issue. but a issue with windows TA.

Everything is connected and working fine. however problem identified and solved.
actually we have two TA's for same technology. for example, windows. one without inputs.conf and other with inputs.conf. Universal forwarded upgrade was successful. I also update the native windows TA with latest version. 6.0. and in my case it has inputs.conf as well with by default disabled everything. So I believe it was taking the precendance over the cutom windows TA( which ended as "_inputs". after deleting local/inputs.con. I start receiving the logs.

thanks woodcock for your kind reply.
Regards,

Rashid

[woodcock]

Check the error logs on the UF from UF CLI; the problem should be very clear. It might be the version of TLS.

[gcusello]

Hi riqbal47010,
a stupid question: are you sure that it isn't changed anything else (ports, firewall routes, etc...)?
Check again the connection (telnet).

Ciao.
Giuseppe

[riqbal47010]

Hi Ciao,

Everything is connected and working fine. however problem identified and solved.
actually we have two TA's for same technology. for example, windows. one without inputs.conf and other with inputs.conf. Upgrade was successful. I also update the native windows TA with latest version. 6.0. and in my case it has inputs.conf as well with by default disabled everything. So I believe it was taking the precendance over the cutom windows TA( which ended as "_inputs". after deleting local/inputs.con. I start receiving the logs.

and thanks for replying a stupid question by .... person.. 🙂

[richgalloway]

Is the forwarder running?

[riqbal47010]

Yes Forwarder is running. However problem get solved.