So i've configured my own little splunk with an OpenSuse forwarder and a Windows server 2008 as indexer, however, the forwarder says it's forwarding but the indexer isn't receiving anything.
i'll post a picture of the forwarder as well of the indexer.
Anybody any tips?
I've already checked the outputs.conf on the forwarder and disabled the firewall on the indexer.
thanks in advance!
Look at the metrics.log on your forwarder, may be some useful info there.
Have you looked at the internal indexes?
index=_* <forwarder name>
What is the IP of your indexer? I see this with a quick look at that log, looks like it might be trying to send to itself?
01-14-2015 14:54:18.046 +0100 INFO StatusMgr - destHost=192.168.2.101, destIp=192.168.2.101, destPort=9997, eventType=connect_fail, publisher=tcpout, sourcePort=8089, statusee=TcpOutputProcessor 01-14-2015 14:54:45.047 +0100 INFO StatusMgr - destHost=192.168.2.101, destIp=192.168.2.101, destPort=9997, eventType=connect_try, publisher=tcpout, sourcePort=8089, statusee=TcpOutputProcessor
It looks like you are confusing forwarder management/deployment server functionality with an indication of forwarding activity. Forwarder management is optional and somewhat more advanced functionality to set up. Have you configured any actual inputs such as file or directory monitors on your forwarder? If not, you will likely not see anything in non-internal indexes since you have not set any inputs up. Let's go back to trsvela's search. If you search your internal index as suggested using your forwarder's hostname or perhaps its IP you might find that it is connected and sending splunk internal logs which get indexed in internal "_*" indexes. Id does look like there might be a problem though, did you perhaps configure some kind of output on your indexer which points to itself?