Getting Data In

Enable light forwarding stopping forwarding

LCM
Contributor

Following situation (Version 4.2.3) :
- Universal Forwarder (no GUI) sends data to Heavy Forwarder
- Heavy Forwarder (GUI) sends data to Indexer (GUI)

This all works just perfect (here status Universal Forwarder & Heavy Forwarder)

Universal Forwarder connected to Heavy Forwarder

09-22-2011 17:03:44.293 +0200 INFO  TcpOutputProc - Connected to idx=xxx.xxx.xxx.xxx:25000

Commands Heavy Forwarder

$ splunk display app SplunkLightForwarder
SplunkLightForwarder          UNCONFIGURED        DISABLED            INVISIBLE           
$ splunk display app SplunkForwarder
SplunkForwarder               UNCONFIGURED        ENABLED             INVISIBLE 

Now the problem: If I enable light forwarding via GUI on the Heavy Forwarder, somehow my Universal Forwarder cannot connect to the ex-Heavy Forwarder anymore!

Commands again on Heavy Forwarder (now Light Forwarder -> no GUI)

$ splunk display app SplunkLightForwarder
SplunkLightForwarder          UNCONFIGURED        ENABLED             INVISIBLE           
$ splunk display app SplunkForwarder
SplunkForwarder               UNCONFIGURED        ENABLED             INVISIBLE

Universal Forwarder not connected anymore

09-22-2011 17:18:44.330 +0200 ERROR TcpOutputFd - Connection to host=xxx.xxx.xxx.xxx:25000 failed

Is this a bug/feature not using the GUI to make a light forwarder out of a heavy forwarder?

1 Solution

LCM
Contributor

I basically disabled all apps: splunk disable app <appname> (even SplunkForwarder & SplunkLightForwarder) Note: Somehow, I couldn't disable eg. the search app!

With command splunk btool [inputs|outputs] list --debug, I could see paramaters Splunk's using while running. I noticed the search app's beeing used with a no-good inputs.conf file for me - so I removed that inputs.conf, since I couldn't disable the app itself.

Furher, in $SPLUNK_HOME/etc/system/local, I edited inputs.conf & outputs.confas followed:

inputs.conf

[splunktcp://:25000]

outputs.conf

[tcpout]
defaultGroup = indexserver.com_25000
disabled = false
indexAndForward = 0

[tcpout:indexserver.com_25000]
autoLB = true
server = indexserver.com:25000

View solution in original post

LCM
Contributor

I basically disabled all apps: splunk disable app <appname> (even SplunkForwarder & SplunkLightForwarder) Note: Somehow, I couldn't disable eg. the search app!

With command splunk btool [inputs|outputs] list --debug, I could see paramaters Splunk's using while running. I noticed the search app's beeing used with a no-good inputs.conf file for me - so I removed that inputs.conf, since I couldn't disable the app itself.

Furher, in $SPLUNK_HOME/etc/system/local, I edited inputs.conf & outputs.confas followed:

inputs.conf

[splunktcp://:25000]

outputs.conf

[tcpout]
defaultGroup = indexserver.com_25000
disabled = false
indexAndForward = 0

[tcpout:indexserver.com_25000]
autoLB = true
server = indexserver.com:25000

vlapeintuit
Explorer

You should be able to convert a heavy forwarder to a light forwarder. I personally have several light forwarders forwarding to forwarders who then send to indexers. In a couple instances i have light forwarders sending to universal forwarders who then send to indexers.

On the light forwarder, are you listening splunktcp on the port configured for forwarding?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...