Getting Data In

Question 1: Splunk Forwarder - configured inputs.conf



I have a standalone Splunk Server.
I have setup the server to revieve data from universal forwarder on a particular port.
I have setup an input on the server (index and web) in etc/system/local/inputs.conf staring with

One forwarder now appears to be sending logs after much fiddling around getting it to work.
The second forwarder is now doing what the first one did. It returns the following message in the logs:

CMConfig - A splunktcp forwarder port is not configured in inputs.conf

Which input file is this message refereing to? Forwarder or Server?

As far as I can tell the inputs.conf is serup.
What should I be looking at to solve this?
Does it need a port per connection?

We are running the latest version of splunk

Thank in advance.

0 Karma


Long time ago - was a network issue

0 Karma


This seems to almost a false message.
The ouputs.conf are configured - correct according to what I can find in the documentation.
The message appears nearly everytime when the forwarder is started. It then appears to reconnect and then it works. If can see the via netstat that an initial connection has a status for TIME_WAIT, and a second connection shows ESTABLISHED. The forwarder then appears to work.

0 Karma

Splunk Employee
Splunk Employee

the forwarder must be missing a configured outputs.conf, please edit to add the definition (use the other one as model) or use the CLI commands to define the forwarding.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...