Forwarder is not showing in Splunk

[shivanshuk]

Hi Splunk Team,

We have installed splunk tool on a windows server 2003 machine say A and Splunk forwarder on another windows server 2008R2 machine say B. Following default ports have been opened between them. 9997,8089 ,8000

The above ports are opened only as outbound connectivity from source to destination.

We have checked the input and output configuration files too. However we are still unable to detect the forwarder in the splunk tool.
Please see the below conf files and snapshot of log files too. Let us know if anything else is required.

Input.conf (splunk from Machine A)

[default]
host = <machine A>

# added from below

[tcp://<machine B IP >:9997]
disabled = 0

`[tcp]
acceptFrom=*

connection_host=ip`

Pls see error msg in splunkd log from machine B where forwarder is installed.

03-20-2013 10:25:19.465 -0400 WARN DeploymentClient - Unable to send handshake message to deployment server. Error status is: rejected
03-20-2013 10:25:31.477 -0400 WARN DeploymentClient - Unable to send handshake message to deployment server. Error status is: rejected
03-20-2013 10:25:43.490 -0400 WARN DeploymentClient - Unable to send handshake message to deployment server. Error status is: rejected
03-20-2013 10:25:55.502 -0400 WARN DeploymentClient - Unable to send handshake message to deployment server. Error status is: rejected
03-20-2013 10:26:07.514 -0400 WARN DeploymentClient - Unable to send handshake message to deployment server. Error status is: rejected
03-20-2013 10:26:16.702 -0400 WARN PubSubConnection - Cannot convert str: to a valid status, returning eRejected.

Please HELP. Thanks in advance.

Thanks
Shivanshu

[shivanshuk]

All,

I have solved this issue by reinstalling the splunk and forwarder, something was messed up on my outputs.conf . 🙂

[piebob]

you must configure the outputs.conf on the forwarder. you must create this file if it does not exist. here is some introductory information about how configuration files work in general in Splunk: http://docs.splunk.com/Documentation/Splunk/latest/Admin/AboutConfigurationFiles

[shivanshuk]

1. I havent done any changes in output.conf file on forwarder. moreover couldnt find any output.conf at below location - \etc\system\local
   Hence i have copied the default output .conf from default to local.

2. could find below error in splunkd logs
   03-20-2013 05:20:23.449 -0400 ERROR TcpOutputProc - LightWeightForwarder/UniversalForwarder not configured. Please configure outputs.conf.

[jrodman]

Incidentally, those warnings are not related to your forwarder problem, unless they are just both indications of a network problem.

[jrodman]

If you're trying to set up forwarding you should:
1 - show the outputs.conf configuration on the forwarder
2 - show any messages in splunkd.log on the forwarder about TcpOutput
3 - verify that when you send a packet to 9997 on the receiver that it gets there (for example network sniff on indexer.)

[bmacias84]

Are you referring to forwarding data to Indexer or a Deployment Server. The Warning you have posted are related to Splunk Deployment Server not inputs.