Getting Data In

Universal forwarder is not working as an intermediate forwarder.

asingla
Communicator

I have the below deployment topology

Program -> Universal Forwarder (UF1) -> Universal Forwarder (UF2) (Intermediate) -> Main Indexer

'->' the flow of TCP message originated from the Program.

I don't see the messages reaching to the main indexer.

Main Indexer is installed on host3 and listening on 44444.

I used command lines to configure the universal forwarders as below

UF2 in installed on host2 and configure to listen on 33333 for tcp messages and forwarding to main indexer.

1) splunk add tcp 33333

2) splunk add forwarder-server host3:44444

UF1 is installed on host1 and configure to listen on 22222 for tcp messages and forwarding to universal forwarder installed on host2.

1) splunk add tcp 22222

2) splunk add forwarder-server host2:33333

My program is sending tcp message to UF1 and I don't see that message reaching all the way to main indexer. FYI, If I configure UF1/UF2 to directly send messages to main indexer , that works for me.

Tags (1)
1 Solution

Steve_G_
Splunk Employee
Splunk Employee

You need to make UF2 a receiver for data getting forwarded from UF1. To enable it, use this command:

./splunk enable listen -auth :

In your case, would be 33333.

See this topic for more details:

http://docs.splunk.com/Documentation/Splunk/latest/Deploy/Enableareceiver

View solution in original post

0 Karma

Steve_G_
Splunk Employee
Splunk Employee

You need to make UF2 a receiver for data getting forwarded from UF1. To enable it, use this command:

./splunk enable listen -auth :

In your case, would be 33333.

See this topic for more details:

http://docs.splunk.com/Documentation/Splunk/latest/Deploy/Enableareceiver

0 Karma

asingla
Communicator

It works. So it's just the CLI bug. Thanks.

0 Karma

Steve_G_
Splunk Employee
Splunk Employee

Try adding this stanza to the inputs.conf file on UF2:

[splunktcp://33333]

0 Karma

asingla
Communicator

That's what I tired at the first place.
./splunk enable listen 33333

Bit I got a command error:

Command error: The subcommand 'listen' is not valid for command 'enable'.

Looks like this command is not supported in Universal Forwarder.

So I thought that I would just add a tcp listener instead.

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...