Universal forwarder is not working as an intermediate forwarder.

[asingla]

I have the below deployment topology

Program -> Universal Forwarder (UF1) -> Universal Forwarder (UF2) (Intermediate) -> Main Indexer

'->' the flow of TCP message originated from the Program.

I don't see the messages reaching to the main indexer.

Main Indexer is installed on host3 and listening on 44444.

I used command lines to configure the universal forwarders as below

UF2 in installed on host2 and configure to listen on 33333 for tcp messages and forwarding to main indexer.

1) splunk add tcp 33333

2) splunk add forwarder-server host3:44444

UF1 is installed on host1 and configure to listen on 22222 for tcp messages and forwarding to universal forwarder installed on host2.

1) splunk add tcp 22222

2) splunk add forwarder-server host2:33333

My program is sending tcp message to UF1 and I don't see that message reaching all the way to main indexer. FYI, If I configure UF1/UF2 to directly send messages to main indexer , that works for me.

[Steve_G_ · Accepted solution]

You need to make UF2 a receiver for data getting forwarded from UF1. To enable it, use this command:

./splunk enable listen -auth :

In your case, would be 33333.

See this topic for more details:

http://docs.splunk.com/Documentation/Splunk/latest/Deploy/Enableareceiver

[asingla]

It works. So it's just the CLI bug. Thanks.

[Steve_G_]

Try adding this stanza to the inputs.conf file on UF2:

[splunktcp://33333]

[asingla]

That's what I tired at the first place.
./splunk enable listen 33333

Bit I got a command error:

Command error: The subcommand 'listen' is not valid for command 'enable'.

Looks like this command is not supported in Universal Forwarder.

So I thought that I would just add a tcp listener instead.