Getting Data In
Highlighted

Why OpenSuse forwarder says "Active forwards 192.168.2.101:9997 but indexer is not receiving"?

Explorer

Hello,

So i've configured my own little splunk with an OpenSuse forwarder and a Windows server 2008 as indexer, however, the forwarder says it's forwarding but the indexer isn't receiving anything.
i'll post a picture of the forwarder as well of the indexer.

Anybody any tips?
I've already checked the outputs.conf on the forwarder and disabled the firewall on the indexer.

thanks in advance!

0 Karma
Highlighted

Re: Why OpenSuse forwarder says "Active forwards 192.168.2.101:9997 but indexer is not receiving"?

Path Finder

Look at the metrics.log on your forwarder, may be some useful info there.

Have you looked at the internal indexes?

 index=_* <forwarder name>
0 Karma
Highlighted

Re: Why OpenSuse forwarder says "Active forwards 192.168.2.101:9997 but indexer is not receiving"?

Explorer

i have found the logfile but can't read it. i'm not that advanced in splunking.

I've uploaded the logfile Here.

0 Karma
Highlighted

Re: Why OpenSuse forwarder says "Active forwards 192.168.2.101:9997 but indexer is not receiving"?

Path Finder

What is the IP of your indexer? I see this with a quick look at that log, looks like it might be trying to send to itself?

01-14-2015 14:54:18.046 +0100 INFO  StatusMgr - destHost=192.168.2.101, destIp=192.168.2.101, destPort=9997, eventType=connect_fail, publisher=tcpout, sourcePort=8089, statusee=TcpOutputProcessor
01-14-2015 14:54:45.047 +0100 INFO  StatusMgr - destHost=192.168.2.101, destIp=192.168.2.101, destPort=9997, eventType=connect_try, publisher=tcpout, sourcePort=8089, statusee=TcpOutputProcessor
0 Karma
Highlighted

Re: Why OpenSuse forwarder says "Active forwards 192.168.2.101:9997 but indexer is not receiving"?

Explorer

The IP address of my forwarder is 192.168.2.104. the IP of my indexer is 192.168.2.104

0 Karma
Highlighted

Re: Why OpenSuse forwarder says "Active forwards 192.168.2.101:9997 but indexer is not receiving"?

Explorer

The forwarder:
alt text

The indexer:
alt text

0 Karma
Highlighted

Re: Why OpenSuse forwarder says "Active forwards 192.168.2.101:9997 but indexer is not receiving"?

Builder

It looks like you are confusing forwarder management/deployment server functionality with an indication of forwarding activity. Forwarder management is optional and somewhat more advanced functionality to set up. Have you configured any actual inputs such as file or directory monitors on your forwarder? If not, you will likely not see anything in non-internal indexes since you have not set any inputs up. Let's go back to trsvela's search. If you search your internal index as suggested using your forwarder's hostname or perhaps its IP you might find that it is connected and sending splunk internal logs which get indexed in internal "_*" indexes. Id does look like there might be a problem though, did you perhaps configure some kind of output on your indexer which points to itself?

0 Karma