Unable to Receive Data from universal forwarder to splunk server

[AmyShah]

Dear All,

I have recently deployed Universal forwarder on Ubuntu and and the server on other Linux machine. I am unable to receive data from the forwarder at all. I am unable to fetch any data when I click Data Summery on the Splunk interface.

[ephemeric]

Check your logs on the SUF and the receiver/indexer. Easiest place to start. Is the SUF connecting and forwarding in the log? Are you receiving and indexing in the log?

From the SUF to receiver in `var/log/splunk/splunkd.log`:

08-23-2021 15:02:18.711 +0000 INFO  AutoLoadBalancedConnectionStrategy [1037 TcpOutEloop] - Found currently active indexer. Connected to idx=10.10.50.206:9997, reuse=1.

On the receiver in `var/log/splunk/metrics.log`:

08-23-2021 15:04:16.198 +0000 INFO  Metrics - group=tcpin_connections, 10.10.50.209:37444:9997, connectionType=cooked, sourcePort=37444, sourceHost=10.10.50.209, sourceIp=10.10.50.209, destPort=9997, kb=15.651, _tcp_Bps=517.002, _tcp_KBps=0.505, _tcp_avg_thruput=12.605, _tcp_Kprocessed=41409.860, _tcp_eps=0.323, _process_time_ms=0, evt_misc_kBps=0.000, evt_raw_kBps=0.452, evt_fields_kBps=0.032, evt_fn_kBps=0.000, evt_fv_kBps=0.000, evt_fn_str_kBps=0.000, evt_fn_meta_dyn_kBps=0.000, evt_fn_meta_predef_kBps=0.000, evt_fn_meta_str_kBps=0.000, evt_fv_num_kBps=0.000, evt_fv_str_kBps=0.000, evt_fv_predef_kBps=0.000, evt_fv_offlen_kBps=0.000, evt_fv_fp_kBps=0.000, build=ddff1c41e5cf, version=8.2.1, os=Linux, arch=x86_64, hostname=spl-suf-01.ephemeric.lan, guid=752B1D7C-B3C5-43D3-A779-EB6C0FCAA965, fwdType=uf, ssl=false, lastIndexer=10.10.50.206:9997, ack=false

 On the SUF:

ncat -v spl-idx-01.ephemeric.lan 9997
Ncat: Version 7.50 ( https://nmap.org/ncat )
Ncat: Connected to 10.10.50.206:9997.

Metrics on the SUF:

08-23-2021 15:12:21.012 +0000 INFO  Metrics - group=tcpout_connections, name=default-autolb-group:10.10.50.206:9997:0, sourcePort=8089, destIp=10.10.50.206, destPort=9997, _tcp_Bps=526.97, _tcp_KBps=0.51, _tcp_avg_thruput=11.06, _tcp_Kprocessed=41656, _tcp_eps=0.33, kb=15.44

[mykol_j]

did you ever get resolution on this?

My deployment server stopped servicing clients -- start throwing this error. No firewall or selinux issues as suggested below...

[richgalloway]

Did you enable receiving on the Linux machine's port 9997?

Did you configure the UF to send data to the Linux machine?  Did you configure any inputs on the UF?  Have you checked the UF's splunkd.log?

[isoutamo]

Check also splunk server firewall and selinux configuration.