Getting Data In

Universal forwarder is not working as an intermediate forwarder.

asingla
Communicator

I have the below deployment topology

Program -> Universal Forwarder (UF1) -> Universal Forwarder (UF2) (Intermediate) -> Main Indexer

'->' the flow of TCP message originated from the Program.

I don't see the messages reaching to the main indexer.

Main Indexer is installed on host3 and listening on 44444.

I used command lines to configure the universal forwarders as below

UF2 in installed on host2 and configure to listen on 33333 for tcp messages and forwarding to main indexer.

1) splunk add tcp 33333

2) splunk add forwarder-server host3:44444

UF1 is installed on host1 and configure to listen on 22222 for tcp messages and forwarding to universal forwarder installed on host2.

1) splunk add tcp 22222

2) splunk add forwarder-server host2:33333

My program is sending tcp message to UF1 and I don't see that message reaching all the way to main indexer. FYI, If I configure UF1/UF2 to directly send messages to main indexer , that works for me.

Tags (1)
1 Solution

Steve_G_
Splunk Employee
Splunk Employee

You need to make UF2 a receiver for data getting forwarded from UF1. To enable it, use this command:

./splunk enable listen -auth :

In your case, would be 33333.

See this topic for more details:

http://docs.splunk.com/Documentation/Splunk/latest/Deploy/Enableareceiver

View solution in original post

0 Karma

Steve_G_
Splunk Employee
Splunk Employee

You need to make UF2 a receiver for data getting forwarded from UF1. To enable it, use this command:

./splunk enable listen -auth :

In your case, would be 33333.

See this topic for more details:

http://docs.splunk.com/Documentation/Splunk/latest/Deploy/Enableareceiver

0 Karma

asingla
Communicator

It works. So it's just the CLI bug. Thanks.

0 Karma

Steve_G_
Splunk Employee
Splunk Employee

Try adding this stanza to the inputs.conf file on UF2:

[splunktcp://33333]

0 Karma

asingla
Communicator

That's what I tired at the first place.
./splunk enable listen 33333

Bit I got a command error:

Command error: The subcommand 'listen' is not valid for command 'enable'.

Looks like this command is not supported in Universal Forwarder.

So I thought that I would just add a tcp listener instead.

0 Karma
Get Updates on the Splunk Community!

Security Highlights | November 2022 Newsletter

 November 2022 2022 Gartner Magic Quadrant for SIEM: Splunk Named a Leader for the 9th Year in a RowSplunk is ...

Platform Highlights | November 2022 Newsletter

 November 2022 Skill Up on Splunk with our New Builder Tech Talk SeriesCan you build it? Yes you can! *play ...

Splunk Education - Fast Start Program!

Welcome to Splunk Education! Splunk training programs are designed to enable you to get started quickly and ...