Getting Data In

How can I forward data in Windows Universal Splunk Forwarder 6.5.0 and a CentOS Splunk Entreprise 6.5.0?

Explorer

Hi, i'm sorry for my poor English, I have a Windows Universal Splunk Forwarder 6.5.0 and a CentOS Splunk Entreprise 6.5.0. I added a new index. I edited and added index = myindex" to "etc\apps\SplunkUniversalForwarder\local\inputs.conf, restated windows service, and tested again with "etc\system\local\inputs.conf", but no data is forwarded in my index or in the main index with default conf. Thank you for your help

0 Karma
1 Solution

Explorer

Hi All,

Thank you very much for all your answers.
Thank you for your so fast answers.

Il found my problem.

On Windows forwarder, in my "inputs.conf", i set index value with quote like this : index = "myindex".

And as it says in Splunk documentation for inputs.conf, WARNING: Do not put the value in quotes. Use host=foo, not host="foo".

Thanks again,

Bye

View solution in original post

Explorer

Hi All,

Thank you very much for all your answers.
Thank you for your so fast answers.

Il found my problem.

On Windows forwarder, in my "inputs.conf", i set index value with quote like this : index = "myindex".

And as it says in Splunk documentation for inputs.conf, WARNING: Do not put the value in quotes. Use host=foo, not host="foo".

Thanks again,

Bye

View solution in original post

SplunkTrust
SplunkTrust

@myitlab1000, if your problem is resolved, please accept an answer to help future readers.

---
If this reply helps you, an upvote would be appreciated.
0 Karma

SplunkTrust
SplunkTrust

Hi myitlab1000,
there could be many reason of this:

  • did you enabled receiving on your Splunk Enterprise?
  • did you configured your outputs.conf on your Forwarder?
  • are you sure that routes are opened between Forwarder and Splunk Enterprise on 9997 port?

to set point 1 see [Settings -- Receiving and Forwarding -- Receiving] if there's on port enabled, usually 9997, dor more information see https://docs.splunk.com/Documentation/Splunk/7.0.2/Forwarding/Enableareceiver .

To configure point 2 run
$SPLUNK_HOME\splunkuniversalforwarder\splunk\bin\splunk add forward-server :
foe more information see http://docs.splunk.com/Documentation/Forwarder/7.0.2/Forwarder/Configuretheuniversalforwarder .

To test point three use
telnet Splunk_Enterprise_IP 9997

Bye.

Giuseppe

0 Karma

Builder

First, if the index you are pointing to is not listed under your security role as "default search" you will need to specify index in the search string. This is always good practice anyway.

index=YOURINDEX OR index=SOMEOTHERINDEX

index=*

The data may not know where to go. You may need to edit/create a ../etc/system/local/outputs.conf

https://docs.splunk.com/Documentation/Forwarder/7.0.2/Forwarder/Configureforwardingwithoutputs.conf

Here is an example of mine where I use two indexers.

[tcpout:group1]
server = hostname.domainname.com:9997,hostname.domainname.com:9997

[tcpout]
defaultGroup = group1

You may also need to create the index on the indexer you are pointing to. If it does not exist the data will fail to reach it's destination.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!