Getting Data In

Why OpenSuse forwarder says "Active forwards 192.168.2.101:9997 but indexer is not receiving"?

nils1433
Explorer

Hello,

So i've configured my own little splunk with an OpenSuse forwarder and a Windows server 2008 as indexer, however, the forwarder says it's forwarding but the indexer isn't receiving anything.
i'll post a picture of the forwarder as well of the indexer.

Anybody any tips?
I've already checked the outputs.conf on the forwarder and disabled the firewall on the indexer.

thanks in advance!

0 Karma

nils1433
Explorer

The forwarder:
alt text

The indexer:
alt text

0 Karma

chanfoli
Builder

It looks like you are confusing forwarder management/deployment server functionality with an indication of forwarding activity. Forwarder management is optional and somewhat more advanced functionality to set up. Have you configured any actual inputs such as file or directory monitors on your forwarder? If not, you will likely not see anything in non-internal indexes since you have not set any inputs up. Let's go back to trsvela's search. If you search your internal index as suggested using your forwarder's hostname or perhaps its IP you might find that it is connected and sending splunk internal logs which get indexed in internal "_*" indexes. Id does look like there might be a problem though, did you perhaps configure some kind of output on your indexer which points to itself?

0 Karma

trsavela
Path Finder

Look at the metrics.log on your forwarder, may be some useful info there.

Have you looked at the internal indexes?

 index=_* <forwarder name>
0 Karma

nils1433
Explorer

i have found the logfile but can't read it. i'm not that advanced in splunking.

I've uploaded the logfile Here.

0 Karma

nils1433
Explorer

The IP address of my forwarder is 192.168.2.104. the IP of my indexer is 192.168.2.104

0 Karma

trsavela
Path Finder

What is the IP of your indexer? I see this with a quick look at that log, looks like it might be trying to send to itself?

01-14-2015 14:54:18.046 +0100 INFO  StatusMgr - destHost=192.168.2.101, destIp=192.168.2.101, destPort=9997, eventType=connect_fail, publisher=tcpout, sourcePort=8089, statusee=TcpOutputProcessor
01-14-2015 14:54:45.047 +0100 INFO  StatusMgr - destHost=192.168.2.101, destIp=192.168.2.101, destPort=9997, eventType=connect_try, publisher=tcpout, sourcePort=8089, statusee=TcpOutputProcessor
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...