Getting Data In

Having trouble getting started

dc18
Explorer

I installed spunk enterprise on a server named s1.  I installed a forwarder on server f1.

Both Windows Server 2019.

When I go into Forwarder Management, s1 sees f1, but I can't DO anything with it.  There's nothing on the Forwarder Management screen to CONFIGURE.  

If I go to Settings | Data Inputs and try to configure "Remote Performance monitoring" (just as a test, just to monitor something), it says it's going to use WMI and that I should use a forwarder instead.

Yes, please.  I want to use a forwarder instead.  I want to user my new forwarder, but I just don't see how.

 

Labels (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

The Forwarder Management screen applies only to Deployment Server (DS) instances.  A DS is a Splunk instance type that ensures each forwarder has the configuration (apps) it needs.  DSs are optional and are unnecessary when you only have a single forwarder.

When you installed the forwarder, did you configure it to forward data to the server?  If so, then you should be seeing data from the forwarder.  Verify that by searching for

index=_internal host=f1

Make sure that returns results for continuing further.

The next step is telling the forwarder what you want it to forward.  By default, it only sends its own logs.  Install the Splunk Add-on for Windows (https://splunkbase.splunk.com/app/742) on the forwarder and turn on (set disabled=0) the inputs you desire.  Be sure to restart the forwarder after changing inputs.conf settings.

 

---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

dc18
Explorer

It's working.  I just added my second forwarder.  Thanks again!

richgalloway
SplunkTrust
SplunkTrust

The Forwarder Management screen applies only to Deployment Server (DS) instances.  A DS is a Splunk instance type that ensures each forwarder has the configuration (apps) it needs.  DSs are optional and are unnecessary when you only have a single forwarder.

When you installed the forwarder, did you configure it to forward data to the server?  If so, then you should be seeing data from the forwarder.  Verify that by searching for

index=_internal host=f1

Make sure that returns results for continuing further.

The next step is telling the forwarder what you want it to forward.  By default, it only sends its own logs.  Install the Splunk Add-on for Windows (https://splunkbase.splunk.com/app/742) on the forwarder and turn on (set disabled=0) the inputs you desire.  Be sure to restart the forwarder after changing inputs.conf settings.

 

---
If this reply helps you, Karma would be appreciated.
0 Karma

dc18
Explorer

I haven't tried this yet but it sounds very helpful.  I'm going to try it later this afternoon.

Thank you!

 

Get Updates on the Splunk Community!

Database Performance Sidebar Panel Now on APM Database Query Performance & Service ...

We’ve streamlined the troubleshooting experience for database-related service issues by adding a database ...

IM Landing Page Filter - Now Available

We’ve added the capability for you to filter across the summary details on the main Infrastructure Monitoring ...

Dynamic Links from Alerts to IM Navigators - New in Observability Cloud

Splunk continues to improve the troubleshooting experience in Observability Cloud with this latest enhancement ...