Getting Data In

Can't feed data into Splunk

essibong1
New Member

I'm trying to know why I can't feed data in splunk. I'm trying to get data from windows servers to splunk, I've created a UF on the Windows server that has the data that needs to be forwarded to splunk. I've configured inputs and outputs.conf files on the forwarder and have also configured inputs.com file on the indexer, all ports are opened, everything is set but I'm still not getting data in splunk. Any help?

Tags (3)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Have you verified the forwarder can connect to the indexer?

---
If this reply helps you, Karma would be appreciated.
0 Karma

mloyola_splunk
Splunk Employee
Splunk Employee

Run this command to check if the forwarder is connected to the receiving instance.
"splunk list forward-server" , the indexer's ip should be in active state.

If its active , the next things to do is to check the splunkd.log of the universal forwarder.

0 Karma
Get Updates on the Splunk Community!

New Year, New Changes for Splunk Certifications

As we embrace a new year, we’re making a small but important update to the Splunk Certification ...

[Puzzles] Solve, Learn, Repeat: Unmerging HTML Tables

[Puzzles] Solve, Learn, Repeat: Unmerging HTML TablesFor a previous puzzle, I needed some sample data, and ...

Enterprise Security (ES) Essentials 8.3 is Now GA — Smarter Detections, Faster ...

As of today, Enterprise Security (ES) Essentials 8.3 is now generally available, helping SOC teams simplify ...