Getting Data In

Unable to get universal forwarder to become active - Linux

jplangan
New Member

Hi, I have configured a basic splunk instance and it is indexing locally. I wanted to add a universal forwarder from another linux server and have the *nix app forward to the indexer. I have configured a data input on the indexer on port 9997 which shows as active (I checked it with strobe from another machine).

I installed the universal forwarder on a different server and set up the indexer as the forward server. It shows as inactive.
/opt/splunkforwarder/bin # ./splunk list forward-server
Your session is invalid. Please login.
Splunk username: admin
Password:
Active forwards:
None
Configured but inactive forwards:
:9997

Any help is appreciated.

Tags (1)
0 Karma

jplangan
New Member

I used the wrong place to configure the receiving port. I needed to use Manager >> Forwarding and receiving >>Configure Receiving to configure it. It does now say that the forwarder is active.

I need to tell the forwarder what to send now, somehow.

Thanks!

0 Karma

yannK
Splunk Employee
Splunk Employee
  • The unix inputs goes to the "os" index by default, check in every indexes with index=*.
  • the UF have a slow thruput by default, it may still be forwarding old logs.
  • when you opened the port 9997 on the indexer, was it as tcp ( in the inputs manager), or as splunktcp (in the forward and received manager) ? The correct one is the second and look like [splunktcp://9997] in inputs.conf
  • no firewall ? try a telnet redactedservername 9997 from the forwarders

finally, read the logs in $SPLUNK_HOME/var/log/splunk/splunkd.log in both side.

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...