Getting Data In

My local Universal Forwarder to AWS Splunk Instance

tentontitan
New Member

I have a splunk instance running on Amazon AWS for testing. I'm trying to configure my home pc to forward (universal forwarder) to the AWS Splunk instance.

So far I'm not seeing anything. My AWS instance is on 1.2.3.4 (fake obviously). And my computers outputs.conf is:

[tcpout]
defaultGroup = group1

[tcpout:group1]
server = 1.2.3.4:9997

I'm not sure if there is anything else I should be doing. My router is allowing traffic on 9997. I can hit the web interface - 1.2.3.4:8000. I'm not sure what is happening.

0 Karma

gjanders
SplunkTrust
SplunkTrust

If you have setup the outputs.conf the _internal data should start going through, so you should be able to search the _internal index for the host sending the data.

Does telnet work to connect to port 9997 on the remote address?
I'm assuming the remote side is listening on port 9997...

0 Karma
Get Updates on the Splunk Community!

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...