Getting Data In

I can not see and add forwarder in Splunk enterprise.

Dyrock
Engager

Hello,

This is my first experience with Splunk as I am setting up a lab.

in VirtualBox I have:

VM1: Act as server: Ubuntu desktop 24.04 LTS - IP: 192.168.0.33 - Installed Splunk Enterprise - Added port 997 under configure receiving - Added Index, named it Sysmonlog. 

VM2: Act as client: Windows 10 IP: 192.168.0.34 - Installed Sysmon - installed Splunk Forwarder - set the developer ip:192.168.0.34 port 8089 - set indexer 192.168.0.33 port 9997.

ping result is successful form both VMsforwarder.pngPS grep.png

When I am about to add the forwarder in my indexer nothing shows up. how should I troubleshoot this to be able to add the forwarder?

Labels (4)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @Dyrock ,

as you can see in https://www.splunk.com/en_us/resources/videos/getting-data-in-with-forwarders.html and read at https://docs.splunk.com/Documentation/Splunk/9.3.0/Data/Forwarddata and https://docs.splunk.com/Documentation/SplunkCloud/9.2.2403/Forwarding/Aboutforwardingandreceivingdat...

You have to:

  • configure the Indexer to receive logs from UFs (I suppose that 997 is a mistyping because the default port is 9997);
  • configure the outputs.conf on your UF to send data to the indexers on the same port.
  • configure the inputs on the UF.

At this point you will see your logs in the Indexer.

Ciao.

Giuseppe

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi @Dyrock ,

as you can see in https://www.splunk.com/en_us/resources/videos/getting-data-in-with-forwarders.html and read at https://docs.splunk.com/Documentation/Splunk/9.3.0/Data/Forwarddata and https://docs.splunk.com/Documentation/SplunkCloud/9.2.2403/Forwarding/Aboutforwardingandreceivingdat...

You have to:

  • configure the Indexer to receive logs from UFs (I suppose that 997 is a mistyping because the default port is 9997);
  • configure the outputs.conf on your UF to send data to the indexers on the same port.
  • configure the inputs on the UF.

At this point you will see your logs in the Indexer.

Ciao.

Giuseppe

Get Updates on the Splunk Community!

Message Parsing in SOCK

Introduction This blog post is part of an ongoing series on SOCK enablement. In this blog post, I will write ...

Exploring the OpenTelemetry Collector’s Kubernetes annotation-based discovery

We’ve already explored a few topics around observability in a Kubernetes environment -- Common Failures in a ...

Use ‘em or lose ‘em | Splunk training units do expire

Whether it’s hummus, a ham sandwich, or a human, almost everything in this world has an expiration date. And, ...