Getting Data In
Highlighted

Universal forwarder not connecting

New Member

I've been trying to set up a universal forwarder to send to Splunk, and it doesn't appear to want to connect. Here's my current outputs.conf:

[tcpout]
defaultGroup = 172.31.**.**_9997

[tcpout:172.31.**.**_9997]
server = 172.31.**.**:9997

[tcpout-server://172.31.**.**:9997]
compressed = false
indexAndForward = false
sslCertPath = /opt/splunkforwarder/etc/auth/server.pem
sslPassword = $1$Ljp9kArNr5Od
sslRootCAPath = /opt/splunkforwarder/etc/auth/cacert.pem
sslVerifyServerCert = false

And this is what I get when I list forward-server:

Active forwards:
        None
Configured but inactive forwards:
        172.31.**.**:9997 (ssl)

My receiver is set up, receives data from other forwarders per our security guy. Any suggestions? We found a firewall issue yesterday, so that got removed. Now our firewall is showing the packets going out. Not sure if I just need to restart our Splunk server, or what. Security guy doesn't want to do that though as we currently have other forwarders sending info to it.

Tags (2)
0 Karma
Highlighted

Re: Universal forwarder not connecting

Ultra Champion

If the other data coming into the Splunk server is sent from other forwarders, you could probably restart the server without problem, the forwarders will notice that the server is down and continue sending when it's up again.

If your Splunk server also receives syslog data (over UDP) you will lose data during a restart, as the sending party will have no way of knowing that the data got lost.

0 Karma
Highlighted

Re: Universal forwarder not connecting

New Member

I don't know what the data is, whether it's UDP vs TCP. Which is why I don't want to shut it off while he's on vacation. If I absolutely need to, then I will. But would rather do whatever I can to the forwarder first to be 115% certain it's not that.

0 Karma
Highlighted

Re: Universal forwarder not connecting

Path Finder

cm

You won't lose any data if you restart the server or splunkd because the syslog will still be present on the local system (or switch etc.) that is sending it and you can always pull it from there.

0 Karma