Getting Data In

How can I forward data in Windows Universal Splunk Forwarder 6.5.0 and a CentOS Splunk Entreprise 6.5.0?

myitlab1000
Explorer

Hi, i'm sorry for my poor English, I have a Windows Universal Splunk Forwarder 6.5.0 and a CentOS Splunk Entreprise 6.5.0. I added a new index. I edited and added index = myindex" to "etc\apps\SplunkUniversalForwarder\local\inputs.conf, restated windows service, and tested again with "etc\system\local\inputs.conf", but no data is forwarded in my index or in the main index with default conf. Thank you for your help

0 Karma
1 Solution

myitlab1000
Explorer

Hi All,

Thank you very much for all your answers.
Thank you for your so fast answers.

Il found my problem.

On Windows forwarder, in my "inputs.conf", i set index value with quote like this : index = "myindex".

And as it says in Splunk documentation for inputs.conf, WARNING: Do not put the value in quotes. Use host=foo, not host="foo".

Thanks again,

Bye

View solution in original post

myitlab1000
Explorer

Hi All,

Thank you very much for all your answers.
Thank you for your so fast answers.

Il found my problem.

On Windows forwarder, in my "inputs.conf", i set index value with quote like this : index = "myindex".

And as it says in Splunk documentation for inputs.conf, WARNING: Do not put the value in quotes. Use host=foo, not host="foo".

Thanks again,

Bye

richgalloway
SplunkTrust
SplunkTrust

@myitlab1000, if your problem is resolved, please accept an answer to help future readers.

---
If this reply helps you, Karma would be appreciated.
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi myitlab1000,
there could be many reason of this:

  • did you enabled receiving on your Splunk Enterprise?
  • did you configured your outputs.conf on your Forwarder?
  • are you sure that routes are opened between Forwarder and Splunk Enterprise on 9997 port?

to set point 1 see [Settings -- Receiving and Forwarding -- Receiving] if there's on port enabled, usually 9997, dor more information see https://docs.splunk.com/Documentation/Splunk/7.0.2/Forwarding/Enableareceiver .

To configure point 2 run
$SPLUNK_HOME\splunkuniversalforwarder\splunk\bin\splunk add forward-server :
foe more information see http://docs.splunk.com/Documentation/Forwarder/7.0.2/Forwarder/Configuretheuniversalforwarder .

To test point three use
telnet Splunk_Enterprise_IP 9997

Bye.

Giuseppe

0 Karma

JDukeSplunk
Builder

First, if the index you are pointing to is not listed under your security role as "default search" you will need to specify index in the search string. This is always good practice anyway.

index=YOURINDEX OR index=SOMEOTHERINDEX

index=*

The data may not know where to go. You may need to edit/create a ../etc/system/local/outputs.conf

https://docs.splunk.com/Documentation/Forwarder/7.0.2/Forwarder/Configureforwardingwithoutputs.conf

Here is an example of mine where I use two indexers.

[tcpout:group1]
server = hostname.domainname.com:9997,hostname.domainname.com:9997

[tcpout]
defaultGroup = group1

You may also need to create the index on the indexer you are pointing to. If it does not exist the data will fail to reach it's destination.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...