Getting Data In

Universal Forwarder not connecting to indexer

ciandro
New Member

OS=Windows Server 2008 SP1 64-bit, Forwarder version = 5.0, Indexer version = 5.0

Windows Firewall = OFF

Scenario = Win VM on same network as Linux VM running the indexer

Errors:
TcpOutputProc - Cooked connection to ip=192.168.1.10:9997 timed out

CMConfig - A splunktcp forwarder port is not configured in inputs.conf

outputs.conf

[tcpout]

defaultGroup = default-autolb-group

[tcpout:default-autolb-group]

server = 192.168.1.10:9997

[tcpout-server://192.168.1.10:9997]

inputs.conf

[default]

host = PIZZA


I don't think i have to configure any port in the inputs.conf file. I already researched that the CMConfig error is a known bug.

Answers?

0 Karma

mship
Path Finder

Before rolling back from 5.0.1 put the following entry in the inputs.conf file of your indexer and restart splunk...

[splunktcp://9997]
Connection_host = none

0 Karma

realdridgespl
Explorer

Seems like it is a "known issue" with 5.0 but not sure if it affects the functionality of the Forwarder.

http://docs.splunk.com/Documentation/Splunk/5.0/ReleaseNotes/Knownissues

"A splunktcp forwarder port is not configured in inputs.conf" error message appears on forwarder/search head/master when it should only appear on the affected slave. (SPL-56019)

0 Karma

conner9
Path Finder

Any chance anyone knows a work around for this, before I uninstall 5.0.1?

0 Karma

realdridgespl
Explorer

I am receiving the same error.
This is on a Universal Forwarder.

CMConfig - A splunktcp forwarder port is not configured in inputs.conf

0 Karma

dwaddle
SplunkTrust
SplunkTrust

Also, you need to make sure nothing is blocking your ability to get there on the indexer side. I would recommend from the Windows machine trying to telnet 192.168.1.10 9997 and see if you can connect with that. It is likely there is a iptables firewall on the linux host blocking your connection.

lguinn2
Legend

On the indexer(s), you must configure a receiving port in inputs.conf

On the forwarder(s), you must configure the same port in outputs.conf. Also on the forwarder(s), you will need to have inputs.conf to collect the data that will be sent to the indexer(s).

There are more details in the manual at Set up forwarding and receiving.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...