Hi, i'm sorry for my poor English, I have a Windows Universal Splunk Forwarder 6.5.0 and a CentOS Splunk Entreprise 6.5.0. I added a new index. I edited and added index = myindex" to "etc\apps\SplunkUniversalForwarder\local\inputs.conf
, restated windows service, and tested again with "etc\system\local\inputs.conf", but no data is forwarded in my index or in the main index with default conf. Thank you for your help
Hi All,
Thank you very much for all your answers.
Thank you for your so fast answers.
Il found my problem.
On Windows forwarder, in my "inputs.conf", i set index value with quote like this : index = "myindex".
And as it says in Splunk documentation for inputs.conf, WARNING: Do not put the value in quotes. Use host=foo, not host="foo".
Thanks again,
Bye
Hi All,
Thank you very much for all your answers.
Thank you for your so fast answers.
Il found my problem.
On Windows forwarder, in my "inputs.conf", i set index value with quote like this : index = "myindex".
And as it says in Splunk documentation for inputs.conf, WARNING: Do not put the value in quotes. Use host=foo, not host="foo".
Thanks again,
Bye
@myitlab1000, if your problem is resolved, please accept an answer to help future readers.
Hi myitlab1000,
there could be many reason of this:
to set point 1 see [Settings -- Receiving and Forwarding -- Receiving] if there's on port enabled, usually 9997, dor more information see https://docs.splunk.com/Documentation/Splunk/7.0.2/Forwarding/Enableareceiver .
To configure point 2 run
$SPLUNK_HOME\splunkuniversalforwarder\splunk\bin\splunk add forward-server :
foe more information see http://docs.splunk.com/Documentation/Forwarder/7.0.2/Forwarder/Configuretheuniversalforwarder .
To test point three use
telnet Splunk_Enterprise_IP 9997
Bye.
Giuseppe
First, if the index you are pointing to is not listed under your security role as "default search" you will need to specify index in the search string. This is always good practice anyway.
index=YOURINDEX OR index=SOMEOTHERINDEX
index=*
The data may not know where to go. You may need to edit/create a ../etc/system/local/outputs.conf
https://docs.splunk.com/Documentation/Forwarder/7.0.2/Forwarder/Configureforwardingwithoutputs.conf
Here is an example of mine where I use two indexers.
[tcpout:group1]
server = hostname.domainname.com:9997,hostname.domainname.com:9997
[tcpout]
defaultGroup = group1
You may also need to create the index on the indexer you are pointing to. If it does not exist the data will fail to reach it's destination.