Not able to see the Forwarder host name in the receivers Host lists

[rajendrapanda]

Hi,

I have installed 4.3.1 as receiver in windows 7 and universal forwarder in RHEl 5. I have configured both as per the documents. But still the forwarder host name /ip not displaying in recevier nor the events.

Below are the log from the matrics.log. 192.168.10.234 is the forwarder and 192.168.10.47 is receiver.

4-18-2012 18:33:23.650 +0530 INFO Metrics - group=tcpin_connections, 192.168.10.234:38846:9997, connectionType=cooked, sourcePort=38846, sourceHost=192.168.10.234, sourceIp=192.168.10.234, destPort=9997, _tcp_Bps=13.63, _tcp_KBps=0.01, _tcp_avg_thruput=0.02, kb=0.41, _tcp_Kprocessed=35.03, _tcp_eps=0.03, build=119532, version=4.3.1, os=Linux, arch=i686, hostname=splunk, guid=AFA78E5B-71F9-43C8-B9B4-38C0C32D014B, fwdType=uf, ssl=false, lastIndexer=192.168.10.47:9997, ack=false

Can anybody check and let me know where could be the mistake.

Regards
Rajendra

[carmackd]

Sanity check -- Have you configured any log monitors in inputs.conf on the forwarder?

However, by default the forwarder will send its internal logs (splunkd etc.) so you should be able to search those on the indexer if you have properly configured the necessary. From the indexer query the following:

index=_internal sourcetype=fwdinfo

If you return results then you know the connection between the two instances are good.