Splunk storm forwarder indexer configuration

[lsudarshan]

Hello all,

I am a novice splunk storm user and just installed the universal forwarder. But the installation expects a indexer ipaddress. I assumed as I was using splunk storm that I don't need to give this... its known by the installation. After installation, I ran the command "splunk.exe list forward-server" and get :

Active forwards:
        None
Configured but inactive forwards:
        forwarder.splunkstorm.com:9997

I tried telneting to forwarder.splunkstorm.com at port 9997 but that fails. Is this something to setup in splunk storm itself?

Appreciate any help.

Thanks,
Sudarshan

[colares]

I've solved this by allowing the port 9997 on firewall.

sudo ufw allow 9997

[sdaniels]

These should help you.

http://splunk-base.splunk.com/answers/58868/splunk-storm-trouble-adding-forwarders
http://splunk-base.splunk.com/answers/58992/datas-are-not-sent-from-my-machine-to-splunk-strom-web-u...

[lsudarshan]

Thanks sdaniels. Will try these suggestions.

[ChrisG]

Did you start by downloading the credentials package from within your Splunk Storm project? See Set up a universal forwarder on Windows in the Splunk Storm documentation.

[lsudarshan]

Thanks Chris... will try it out.

[ChrisG]

Hm, then yeah, your firewall might be blocking something, or you might have a port issue from some setting in the AWS management console (see the first posting sdaniels listed). And you need to tell the forwarder what to monitor (see YannK's answer in the second posting that sdaniels listed). Beyond that, someone with deeper knowledge is going to have to help you here!

[lsudarshan]

Thanks for the answer Chris. I did indeed install the credentials package which created an app under the forwarder. But the command "splunk.exe list forward-server" still gives :

Active forwards:
None
Configured but inactive forwards:
forwarder.splunkstorm.com:9997

The curious thing is I can't telnet to forwarder.splunkstorm.com at port 9997.