Unable to get universal forwarder to become active - Linux

[jplangan]

Hi, I have configured a basic splunk instance and it is indexing locally. I wanted to add a universal forwarder from another linux server and have the *nix app forward to the indexer. I have configured a data input on the indexer on port 9997 which shows as active (I checked it with strobe from another machine).

I installed the universal forwarder on a different server and set up the indexer as the forward server. It shows as inactive.
/opt/splunkforwarder/bin # ./splunk list forward-server
Your session is invalid. Please login.
Splunk username: admin
Password:
Active forwards:
None
Configured but inactive forwards:
:9997

Any help is appreciated.

[jplangan]

I used the wrong place to configure the receiving port. I needed to use Manager >> Forwarding and receiving >>Configure Receiving to configure it. It does now say that the forwarder is active.

I need to tell the forwarder what to send now, somehow.

Thanks!

[yannK]

• The unix inputs goes to the "os" index by default, check in every indexes with index=*.
• the UF have a slow thruput by default, it may still be forwarding old logs.
• when you opened the port 9997 on the indexer, was it as tcp ( in the inputs manager), or as splunktcp (in the forward and received manager) ? The correct one is the second and look like [splunktcp://9997] in inputs.conf
• no firewall ? try a telnet redactedservername 9997 from the forwarders

finally, read the logs in $SPLUNK_HOME/var/log/splunk/splunkd.log in both side.