Getting Data In

Indexer isn't receiving data from the Universal Forwarder



I'm having issues receiving data on my Indexer from the Universal Forwarder. Prior to installing the Universal Forwarder, I confirmed that the Indexer was able to receive data. However, after installing the Universal Forwarder and configuring according to Deployment instructions, I confirmed that the Forward-Server was "Active", Netstat was ESTABLISHED on both servers, the Inputs.conf and Outputs.conf files on the Universal Forwarder were configured to receive UDP Traffic and send traffic to the Indexer. For the purposes of troubleshooting, my OS Firewall has been turned off and I also confirmed that data is showing up in the index= _internal host=forward-server. Data is not updating in the Search Head. Does anyone have any ideas, or know of anything that has been missed.


[root@SplunkForwarder bin]# ./splunk list forward-server
Active forwards:
Configured but inactive forwards:

[root@SplunkForwarder local]# more inputs.conf
host = Splunk_Forwarder

index = pan_logs
sourcetype = pan_log
connection_host = ip
no_appending_timestamp = true
disabled = 1


disabled = false

[root@SplunkForwarder local]# more outputs.conf
defaultGroup = default-autolb-group

server =



[root@SplunkLinux bin]# ./splunk display listen
Receiving is enabled on port 9997.

0 Karma


Solved my issue by add the information in the location "$SPLUNK_HOME/etc/apps/search/local/inputs.conf"

This document is also a great resource:

0 Karma


Is there really data arriving on port 5514 on the forwarder?

0 Karma


Just doubled-checked. If data is coming in, it's coming through the Indexer not from the Forwarder.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!