Universal Forwarder

[slopresto]

I have multiple LAMP servers that I am looking to monitor with Splunk. I got my server setup last Friday and setup the Universal forwarder on a couple of VM's that i am using for testing. The problem is that these hosts do not show up on my server.

I am running the configs from the *nix module on my forwarder test systems and was expecting them to show up when I was viewing the os index. Unfortunately, I only see a single host.

I have verified that the forwarder is connecting to the server. A quick view of tcpdump output shows that information is being sent, but I am not sure what the server is doing with it; as the UI only shows the index server host and no others.

Am I missing something basic here?

[dwaddle]

Usually, host= is set to FQDN in the [defaults] stanza of $SPLUNK_HOME/etc/system/local/inputs.conf. If this value is set incorrectly, Splunk could be assigning the wrong host value for your data.

This is an instance where btool can help. On your forwarders, run this command:

splunk cmd btool --debug inputs list

And look for your various inputs and see what host= is set to for them.