Getting Data In

Indexer isn't receiving data from the Universal Forwarder

tjohnson2
Explorer

Hello,

I'm having issues receiving data on my Indexer from the Universal Forwarder. Prior to installing the Universal Forwarder, I confirmed that the Indexer was able to receive data. However, after installing the Universal Forwarder and configuring according to Deployment instructions, I confirmed that the Forward-Server was "Active", Netstat was ESTABLISHED on both servers, the Inputs.conf and Outputs.conf files on the Universal Forwarder were configured to receive UDP Traffic and send traffic to the Indexer. For the purposes of troubleshooting, my OS Firewall has been turned off and I also confirmed that data is showing up in the index= _internal host=forward-server. Data is not updating in the Search Head. Does anyone have any ideas, or know of anything that has been missed.


FORWARDER

[root@SplunkForwarder bin]# ./splunk list forward-server
Active forwards:
10.202.192.33:9997
Configured but inactive forwards:
None


[root@SplunkForwarder local]# more inputs.conf
[default]
host = Splunk_Forwarder

[udp://5514]
index = pan_logs
sourcetype = pan_log
connection_host = ip
no_appending_timestamp = true
disabled = 1

[udp://514]

disabled = false

[root@SplunkForwarder local]# more outputs.conf
[tcpout]
defaultGroup = default-autolb-group

[tcpout:default-autolb-group]
server = 10.202.192.33:9997

[tcpout-server://10.202.192.33:9997]


INDEXER

[root@SplunkLinux bin]# ./splunk display listen
Receiving is enabled on port 9997.

0 Karma

tjohnson2
Explorer

Solved my issue by add the information in the location "$SPLUNK_HOME/etc/apps/search/local/inputs.conf"

This document is also a great resource: http://docs.splunk.com/Documentation/Splunk/6.2.3/Data/Useforwardingagentstogetdata

0 Karma

lguinn2
Legend

Is there really data arriving on port 5514 on the forwarder?

0 Karma

tjohnson2
Explorer

Just doubled-checked. If data is coming in, it's coming through the Indexer not from the Forwarder.

0 Karma
Get Updates on the Splunk Community!

New Case Study Shows the Value of Partnering with Splunk Academic Alliance

The University of Nevada, Las Vegas (UNLV) is another premier research institution helping to shape the next ...

How to Monitor Google Kubernetes Engine (GKE)

We’ve looked at how to integrate Kubernetes environments with Splunk Observability Cloud, but what about ...

Index This | How can you make 45 using only 4?

October 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...