Getting Data In

Not getting any Data with Xenapp.

joefixit71
New Member

I installed a Instance of Splunk, setup 3 servers with the forwarders installed pointing to the main instance on port 9997. (License server, XenApp Data Collector/Xml broker and regular Xenapp server. I copied the folders for the snapins for each type of server to the "C:\Program Files\SplunkUniversalForwarder\etc\deployment-apps" The Index is installed for xenapp since it gets installed during the xenapp snapin install but its not receiving any data.
I get the message "no matching fields exist" on top and "No results found" I don't see any Farms listed to click on so its not even connecting to the Farm servers I tried to add. I don't have any firewalls in between so its not blocking any ports. I setup a receiver listening on port 9997 on the Main instance but still no data.
This below is the Output file of a server thats forwarding data.
[tcpout]
defaultGroup = default-autolb-group

[tcpout-server://nwnifictx040.usa-ed.net:9997]

[tcpout:default-autolb-group]
disabled = false
server = nwnifictx040.usa-ed.net:9997,nwnifictx040:9997

[tcpout-server://nwnifictx040:9997]

This is a server forwarding data's Input file
[default]
host = NWNIFICTX030

let me know if any other information is needed.

This is a evaluation setup that I was really trying to get a good look at before tomorrow.
thanks,
Matt

0 Karma

joefixit71
New Member

I did that from the powershell command window and still "no results found"

0 Karma

joefixit71
New Member

Still not seeing any data after i copied to the correct directory and restarted the splunk service everywhere.. I actually saw a graph look like it was goin to start then it went away..

0 Karma

joefixit71
New Member

Still not seeing any data after i copied to the correct directory and restarted the splunk service everywhere.. I actually saw a graph look like it was goin to start then it went away..

0 Karma

jconger
Splunk Employee
Splunk Employee

The snapins should go in "C:\Program Files\SplunkUniversalForwarder\etc\apps"

0 Karma

joefixit71
New Member

Still not seeing any data after i copied to the correct directory and restarted the splunk service everywhere.. I actually saw a graph look like it was goin to start then it went away..

0 Karma
Get Updates on the Splunk Community!

Splunk Enterprise Security: Your Command Center for PCI DSS Compliance

Every security professional knows the drill. The PCI DSS audit is approaching, and suddenly everyone's asking ...

Developer Spotlight with Guilhem Marchand

From Splunk Engineer to Founder: The Journey Behind TrackMe    After spending over 12 years working full time ...

Cisco Catalyst Center Meets Splunk ITSI: From 'Payments Are Down' to Root Cause in ...

The Problem: When Networks and Services Don't Talk Payment systems fail at a retail location. Customers are ...