Good Morning all ,
I have a standalone splunk installation , there is no syslog data being transmitted and Im really not getting any data collected from the universal forwarded it is phoning home however i dont see any data from the linux server that it is installed on. I dont see any log modifications or anything . am i mis understanding the UF
Hi @socks,
let me better understand your architecture:
is it correct?
have you seen the documentation about getting data in from forwarders at https://docs.splunk.com/Documentation/Splunk/latest/Data/Usingforwardingagents ?
Did you configured receinving in the Splunk Server [Settings -- Forwarding and Receiving -- Receiving]?
Did you configured your Universal Forwarder to send data to Splunk modifyng outputs.conf ?
https://docs.splunk.com/Documentation/Forwarder/9.0.1/Forwarder/Configuretheuniversalforwarder
Did you configured inputs?
Ciao.
Giuseppe
Hi
here is instructions how to install UF and enable receiving on indexer (on all in one node). https://docs.splunk.com/Documentation/Forwarder/9.0.1/Forwarder/Installanixuniversalforwarder
Your issue sounds like you haven’t configured any inputs! Have you any serverclasses and apps on your server side? Have you check that you have any internal logs from that node? Just check from MC or just wit SPL
index=_internal host=<your UF> sourcetype=splunkd earliest=0
If you found any events then it can send events to server. If not then probably you are missing outputs.conf https://docs.splunk.com/Documentation/Splunk/9.0.1/Admin/Outputsconf. Just add this to point your server and then internal events should found on server.
r. Ismo