Hi @theitgui
you probably have to do some traceback steps
1) you have enabled inbound 9997 on deployment server i assume you did it on the VPC but did you configure in your splunk server under settings >>Forwarding and recieving >> Recieve data
you have to add 9997
2) i guess outputs.conf is correct thats why they are showing up in the forwarder maangement
3) check if the path are correctly configured in the monitor stanza in inputs.conf .if you are just uploading the file then don't need to look into inputs.conf and do check the index as well by playing with alltime options
Thanks
venky
if it helps karma points are appreciated/if it resolves acceptance of solution is appreciated
firstly can you clarify do you have seperate indexer and deployment server ?? or is it one splunk standalone server ?? where you have everything in one server thats bit confusing when you say deployment server
secondly if if you have setup the servers then it can't be already there it always need to be configured please see the screenshot and configure 9997
and if you have multiple inputs.conf try to delete the duplicates or you should use the btool command to see which inputs.conf is taking the precedence and probably thats the culprit where you might have to change the index name
./splunk btool <configFileName> list --debug
I apologize for any confusion of terms. I have a deployment server acting as an indexer and three universal forwarders in addition. I am not well versed in Splunk terms and wasn't aware that I didn't need a deployment server.
As far as multiple inputs.conf, I was moreso referring to them being in many locations, not having duplicate entries in any one location. The command did not return any data. Thank you for your help.
# Version 8.2.6
#
# This file contains an example outputs.conf. Use this file to configure
# forwarding in a distributed set up.
#
# To use one or more of these configurations, copy the configuration block into
# outputs.conf in $SPLUNK_HOME/etc/system/local/. You must restart Splunk to
# enable configurations.
#
# To learn more about configuration files (including precedence) please see the
# documentation located at
# http://docs.splunk.com/Documentation/Splunk/latest/Admin/Aboutconfigurationfiles
# Specify a target group for an IP:PORT which consists of a single receiver.
# This is the simplest possible configuration; it sends data to the host at
# 10.1.1.197 on port 9997.
[tcpout:group1]
server=192.168.0.2:9997
The above is what I've got. I simply took the first example and put it in. Server IP is a pretty generic internal IP so no worries there. Good luck getting to it. 🙂 Thank you very much for your help. It means a lot.
Also, when I attempt the CLI command, it just hangs. Never completes.
