My forwarder was working fine but stopped and I can't get it running again. Running the splunk start
command appears to be working fine but then it fails at the last step.
No logs are being generated in splunkd.log
but some logs are generated in splunkd-utility.log
:
I am not certain what is causing it from starting. Any help would be appreciated. Thanks
Hi @mawomommoh,
Check the following,
Okay. I checked my log files again and I can see a bunch of errors and warnings from before I started encountering the issue:
I have checked my splunk server and deleted/created port 9997 which I am using for the forwarding but still no difference.
Hi @mawomommoh,
Check your index configuration (host and ip) in output conf of forwarder and make sure that they are reachable and not blocked by firewall or acl