How can I forward data in Windows Universal Splunk Forwarder 6.5.0 and a CentOS Splunk Entreprise 6.5.0?

[myitlab1000]

Hi, i'm sorry for my poor English, I have a Windows Universal Splunk Forwarder 6.5.0 and a CentOS Splunk Entreprise 6.5.0. I added a new index. I edited and added index = myindex" to "etc\apps\SplunkUniversalForwarder\local\inputs.conf, restated windows service, and tested again with "etc\system\local\inputs.conf", but no data is forwarded in my index or in the main index with default conf. Thank you for your help

[myitlab1000 · Accepted solution]

Hi All,

Thank you very much for all your answers.
Thank you for your so fast answers.

Il found my problem.

On Windows forwarder, in my "inputs.conf", i set index value with quote like this : index = "myindex".

And as it says in Splunk documentation for inputs.conf, WARNING: Do not put the value in quotes. Use host=foo, not host="foo".

Thanks again,

Bye

[richgalloway]

@myitlab1000, if your problem is resolved, please accept an answer to help future readers.

[gcusello]

Hi myitlab1000,
there could be many reason of this:

• did you enabled receiving on your Splunk Enterprise?
• did you configured your outputs.conf on your Forwarder?
• are you sure that routes are opened between Forwarder and Splunk Enterprise on 9997 port?

to set point 1 see [Settings -- Receiving and Forwarding -- Receiving] if there's on port enabled, usually 9997, dor more information see https://docs.splunk.com/Documentation/Splunk/7.0.2/Forwarding/Enableareceiver .

To configure point 2 run
$SPLUNK_HOME\splunkuniversalforwarder\splunk\bin\splunk add forward-server :
foe more information see http://docs.splunk.com/Documentation/Forwarder/7.0.2/Forwarder/Configuretheuniversalforwarder .

To test point three use
telnet Splunk_Enterprise_IP 9997

Bye.

Giuseppe

[JDukeSplunk]

First, if the index you are pointing to is not listed under your security role as "default search" you will need to specify index in the search string. This is always good practice anyway.

index=YOURINDEX OR index=SOMEOTHERINDEX

index=*

The data may not know where to go. You may need to edit/create a ../etc/system/local/outputs.conf

https://docs.splunk.com/Documentation/Forwarder/7.0.2/Forwarder/Configureforwardingwithoutputs.conf

Here is an example of mine where I use two indexers.

[tcpout:group1]
server = hostname.domainname.com:9997,hostname.domainname.com:9997

[tcpout]
defaultGroup = group1

You may also need to create the index on the indexer you are pointing to. If it does not exist the data will fail to reach it's destination.