What am I missing to get a successful connection between my Universal Forwarder and the sandbox?

[appzen]

I followed the tutorial very carefully on setting up the forwarder on my two Tomcat servers. Now I am trying to verify that I can actually receive data from my catalina logs to my sandbox. When I go to 'Add Data', and click on 'forward' it gives me the notice: "There are currently no forwarders configured as deployment clients to this instance." But at the top of my screen I get another notice stating that: "Forwarding to indexer group default-autolb-group blocked for 1200 seconds.", which 'default-autolb-group' is the defaultGroup in my /opt/splunkforwarder/etc/system/local/output.conf file. I think that I am close on getting a connection but I am missing some step to complete it. Can someone help me on what I missing to verify a successful connection?

Also, my inputs.conf file only has the ip address of my server; do I need to put information about my catalina log file and if so what is the format, thanks!

[appzen]

lol man that was an experience, but every time i do a query i get these flags:

Info.csv being bloated by "lookup" log messages . Will not log additional errors. Refer search.log
The limit has been reached for log messages in info.csv. 1 messages have not been written to info.csv. Please refer search.log for these messages or limits.conf to configure this limit.
The lookup table 'dropdownsLookup' does not exist. It is referenced by configuration '(?i)source::....zip(.\d+)?'.
The lookup table 'dropdownsLookup' does not exist. It is referenced by configuration 'ActiveDirectory'.
The lookup table 'dropdownsLookup' does not exist. It is referenced by configuration 'BoxAppForSplunk_controller-too_small'.
The lookup table 'dropdownsLookup' does not exist. It is referenced by configuration 'Linux:SELinuxConfig'.
The lookup table 'dropdownsLookup' does not exist. It is referenced by configuration 'PerformanceMonitor'.
The lookup table 'dropdownsLookup' does not exist. It is referenced by configuration 'Splunk_TA_aws-RestEndpoints-account-list-too_small'.
The lookup table 'dropdownsLookup' does not exist. It is referenced by configuration 'WinNetMonMk'.
The lookup table 'dropdownsLookup' does not exist. It is referenced by configuration 'WinNetMonMk'.
The lookup table 'dropdownsLookup' does not exist. It is referenced by configuration 'WinPrintMon'.
The lookup table 'dropdownsLookup' does not exist. It is referenced by configuration 'WinRegistry'.

[appzen]

The lookup table 'dropdownsLookup' does not exist. It is referenced by configuration 'WinWinHostMon'.
The lookup table 'dropdownsLookup' does not exist. It is referenced by configuration '__singleline'.
The lookup table 'dropdownsLookup' does not exist. It is referenced by configuration '_json'.
The lookup table 'dropdownsLookup' does not exist. It is referenced by configuration 'access_combined'.
The lookup table 'dropdownsLookup' does not exist. It is referenced by configuration 'access_combined_wcookie'.
The lookup table 'dropdownsLookup' does not exist. It is referenced by configuration 'access_common'.
The lookup table 'dropdownsLookup' does not exist. It is referenced by configuration 'aix_secure'.
The lookup table 'dropdownsLookup' does not exist. It is referenced by configuration 'anaconda'.
The lookup table 'dropdownsLookup' does not exist. It is referenced by configuration 'anaconda_syslog'.
The lookup table 'dropdownsLookup' does not exist. It is referenced by configuration 'apache_error'.
The lookup table 'dropdownsLookup' does not exist. It is referenced by configuration 'asterisk_cdr'.

[appzen]

are these errors from my connection or sandbox settings?

[chanfoli]

This is something missing/misconfigured on your sandbox. Did you install any additional apps to your sandbox?

This sounds like a topic for a new question 😉

[appzen]

One more question, sorry but I have two servers that I need to keep track of, and I am following the same steps for the other server but I am not seeing it get picked up from sandbox. Would I just need to do apply the same settings, or is there something extra that needs to be done when trying to track two servers at once?

[chanfoli]

The same configuration steps should work without any additional changes to the sandbox. Of course you might want do specify a different default host in your inputs.conf so that you can tell the hosts apart. Don't forget to install the credentials app on the additional forwarder.

If you found my answer/comments helpful please accept the answer and/or give points. Thanks, I am glad you were able to get it working.

[appzen]

sorry it just took awhile 🙂 showed up

[appzen]

Yea, I installed sandbox for linux and unix but stopped with the process when I saw the (optional) on the step number from one of the forum questions you sent me, ill ask how to get rid of that, but thanks again for all your help!

[appzen]

no it exists, but I have to change permission

[appzen]

01-09-2015 19:40:02.418 +0000 INFO ServerConfig - Will generate GUID, as none found on this server.
01-09-2015 19:40:02.418 +0000 INFO ServerConfig - My newly generated GUID is C0A9901E-8B38-4435-8677-2DA23C1595EA
01-09-2015 19:40:02.419 +0000 INFO ServerConfig - My server name is "ip-172-31-35-141".
01-09-2015 19:40:02.419 +0000 INFO ServerConfig - Found no site defined in server.conf
01-09-2015 19:40:02.419 +0000 INFO ServerConfig - My hostname is "ip-172-31-35-141".
01-09-2015 19:40:02.452 +0000 INFO ServerConfig - Setting HTTP server compression state=on
01-09-2015 19:40:02.452 +0000 INFO ServerConfig - Setting HTTP client compression state=0 (false)
01-09-2015 19:40:02.452 +0000 INFO ServerConfig - Default output queue for file-based input: parsingQueue.
01-09-2015 19:40:02.481 +0000 INFO LicenseMgr - Initing LicenseMgr
01-09-2015 19:40:02.481 +0000 INFO LMConfig - serverName=ip-172-31-35-141 guid=C0A9901E-8B38-4435-8677-2DA23C1595EA
01-09-2015 19:40:02.481 +0000 INFO LMConfig - connection_timeout=30
01-09-2015 19:40:02.481 +0000 INFO LMConfig - send_timeout=30
01-09-2015 19:40:02.481 +0000 INFO LMConfig - receive_timeout=30
01-09-2015 19:40:02.481 +0000 INFO LMConfig - squash_threshold=2000
01-09-2015 19:40:02.481 +0000 INFO LMConfig - strict_pool_quota=1
01-09-2015 19:40:02.481 +0000 INFO LMConfig - key=pool_suggestion not found in licenser stanza of server.conf, defaulting=''

[chanfoli]

Hello, that looks like pretty normal startup stuff. I would look at near the end of the log for anything relating to the monitor you set up. It looks like your forwarding connection is okay based on the list forward-servers output.

[appzen]

and it appears that I cant access my splunkd.logs from my forwarder

[chanfoli]

Sorry missed this. Do not have administrative access to this system or are you just not finding the log?

[chanfoli]

SPLUNKHOME/var/log/splunk/splunkd.logs

On *nix home is usually /opt/splunkforwarder and on windows it would be under Program Files/splunkforwarder

[appzen]

and if my inputs.conf file isn't correctly setup with a monitor, would that be the reason why I am still not picking up the forwarder?