Getting Data In

Unable to Receive Data from universal forwarder to splunk server

AmyShah
Loves-to-Learn

Dear All,

 

I have recently deployed Universal forwarder on Ubuntu and and the server on other Linux machine. I am unable to receive data from the forwarder at all. I am unable to fetch any data when I click Data Summery on the Splunk interface.

 

Labels (1)
0 Karma

ephemeric
Contributor

Check your logs on the SUF and the receiver/indexer. Easiest place to start. Is the SUF connecting and forwarding in the log? Are you receiving and indexing in the log?

From the SUF to receiver in `var/log/splunk/splunkd.log`:

08-23-2021 15:02:18.711 +0000 INFO  AutoLoadBalancedConnectionStrategy [1037 TcpOutEloop] - Found currently active indexer. Connected to idx=10.10.50.206:9997, reuse=1.

On the receiver in `var/log/splunk/metrics.log`:

08-23-2021 15:04:16.198 +0000 INFO  Metrics - group=tcpin_connections, 10.10.50.209:37444:9997, connectionType=cooked, sourcePort=37444, sourceHost=10.10.50.209, sourceIp=10.10.50.209, destPort=9997, kb=15.651, _tcp_Bps=517.002, _tcp_KBps=0.505, _tcp_avg_thruput=12.605, _tcp_Kprocessed=41409.860, _tcp_eps=0.323, _process_time_ms=0, evt_misc_kBps=0.000, evt_raw_kBps=0.452, evt_fields_kBps=0.032, evt_fn_kBps=0.000, evt_fv_kBps=0.000, evt_fn_str_kBps=0.000, evt_fn_meta_dyn_kBps=0.000, evt_fn_meta_predef_kBps=0.000, evt_fn_meta_str_kBps=0.000, evt_fv_num_kBps=0.000, evt_fv_str_kBps=0.000, evt_fv_predef_kBps=0.000, evt_fv_offlen_kBps=0.000, evt_fv_fp_kBps=0.000, build=ddff1c41e5cf, version=8.2.1, os=Linux, arch=x86_64, hostname=spl-suf-01.ephemeric.lan, guid=752B1D7C-B3C5-43D3-A779-EB6C0FCAA965, fwdType=uf, ssl=false, lastIndexer=10.10.50.206:9997, ack=false

 On the SUF:

ncat -v spl-idx-01.ephemeric.lan 9997
Ncat: Version 7.50 ( https://nmap.org/ncat )
Ncat: Connected to 10.10.50.206:9997.

 

Metrics on the SUF:

08-23-2021 15:12:21.012 +0000 INFO  Metrics - group=tcpout_connections, name=default-autolb-group:10.10.50.206:9997:0, sourcePort=8089, destIp=10.10.50.206, destPort=9997, _tcp_Bps=526.97, _tcp_KBps=0.51, _tcp_avg_thruput=11.06, _tcp_Kprocessed=41656, _tcp_eps=0.33, kb=15.44

 

0 Karma

mykol_j
Communicator

did you ever get resolution on this?

My deployment server stopped servicing clients -- start throwing this error. No firewall or selinux issues as suggested below...

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Did you enable receiving on the Linux machine's port 9997?

Did you configure the UF to send data to the Linux machine?  Did you configure any inputs on the UF?  Have you checked the UF's splunkd.log?

---
If this reply helps you, Karma would be appreciated.
0 Karma

isoutamo
SplunkTrust
SplunkTrust
Check also splunk server firewall and selinux configuration.
Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...