Getting Data In
Highlighted

Why am I getting "Connection to host=:9997 failed" after configuring a universal forwarder on Linux?

New Member

I have configured a universal forwarder on one of our Linux systems. When i check the logs it shows

Connection to host=192.168.2.1:9997 failed (where 192.168.2.1 is splunk enterprise ) server.

I have referred to this solution but didn't work http://answers.splunk.com/answers/49833/splunk-forwarder-connection-refused-from-splunk-indexer.html

0 Karma
Highlighted

Re: Why am I getting "Connection to host=:9997 failed" after configuring a universal forwarder on Linux?

SplunkTrust
SplunkTrust

hi nitheeshp86,

do the usual troubleshooting like:

cheers, MuS

0 Karma