Configuring Input stanza for forwarder

[rajindersingh]

I used this command to configure splunk forwarder using cli

splunk add monitor d:\logs -Follow-only True

I got no errors but I don't see any changes in my input.conf

I tried add the monitor again and I got a message that monitor is already present.

I can telnet from my forwarder vm to splunk vm over port 9997 and 8089

In my splunkd log file

05-09-2015 04:18:29.694 +0000 ERROR TcpOutputFd - Read error. An established connection was aborted by the software in your host machine.
05-09-2015 04:18:59.702 +0000 ERROR TcpOutputFd - Read error. An established connection was aborted by the software in your host machine.
05-09-2015 04:19:29.708 +0000 ERROR TcpOutputFd - Read error. An established connection was aborted by the software in your host machine.
05-09-2015 04:19:38.075 +0000 WARN TcpOutputProc - Forwarding to indexer group default-autolb-group blocked for 9400 seconds.
05-09-2015 04:19:59.720 +0000 ERROR TcpOutputFd - Read error. An established connection was aborted by the software in your host machine.

I know that firewall on my splunk server allows connections over port 8089 and 9997.

Do I have to configure outgoing firewall on the server running splunk forwarder?

Thanks

[rajindersingh]

Thanks esix_splunk

rookie mistake.

[esix_splunk · Accepted solution]

Port 8089 is the management port for Splunkd.

You should be forwarding to the Splunkinput port configured on your indexer. Typically this is TCP9997.

Update your outputs to that, and should resolve your issue.

[rajindersingh]

Output.conf was configured by the splunk universal forwareder installer.

[tcpout]
defaultGroup = default-autolb-group

[tcpout:default-autolb-group]
server = 10.0.0.37:8089

[tcpout-server://10.0.0.37:8089]

This server is up and running. It allows firewall traffic over 8089 and 9997.

Any other suggestions?

Thanks

[esix_splunk]

You also need to have an outputs.conf configured on your forwarder. This lets the UF know where it should send the data collected in the inputs.conf to.

In your case, the outputs.conf should point to your indexer.

See : http://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Deployaforwarder