Getting isHttpOutConfigured=NOT_CONFIGURED in Splunkd logs

[prajwal_94]

I had defined the complete path in inputs.conf and restarted the Splunkforwarder but got error in Splunkd logs.

Kindly refer the attachment.

IMG_0870.jpeg

 

[prajwal_94]

Hi @richgalloway ,Thanks for the reply but may I know what needs to be done here so that data is forwarded to indexer and then search results are obtained.

[richgalloway]

You've already done what is necessary.  A TCP connection to the indexer(s) is all you need.

Forwarders are a one-way device.  They send data to indexers, but do not obtain search results.  Searches and their results go through a search head.

[prajwal_94]

Hi @richgalloway ,even TCP connection is setup to the indexer and its port. No firewall blocking as well but still no events being returned on search. 

[richgalloway]

The message appears because httpout is not configured.  The outputs.conf file shown defines tcpout, not httpout.  Since the [httpout] stanza is optional, these INFO messages can be ignored.