Getting Data In

Why am I unable to connect my Windows universal forwarder to the Sandbox?

lehrfeld
Path Finder

All -

I would like to experiment with Splunk Cloud but I am having an issue getting any data into my sandbox.

I installed the windows UF on my laptop and told it to forward windows events to my cloud instance (prd-p-mycloud.cloud.splunk.com:9997). I then downloaded and installed the credentials from the UF App in Splunk Cloud.

All the documentation I have been able to find indicates that is all I need to do. But for some reason in my splunkd log file I am getting the WARN TcpOutputProc - Cooked connection to ip=x.x.x.x:9997 timed out error.

When I run a netstat, I get an ESTABLISHED connection to port 9997 with Splunk Cloud. I even went so far as to turn off my Windows firewall and still nothing.

Any thoughts or docs that I may have missed to set this up?

Thanks!

Mike

1 Solution

ppablo
Retired

Hi @lehrfeld

Here's a previous Answers post covering the process for setting up a forwarder for the Sandbox that might be helpful. There is a note specifically for Windows forwarders at the very bottom of the answer. Not sure if that's part of the issue you're experiencing, but worth checking out. http://answers.splunk.com/answers/214420/how-do-i-setup-a-splunk-cloud-trial-sandbox-forwar.html

View solution in original post

ppablo
Retired

Hi @lehrfeld

Here's a previous Answers post covering the process for setting up a forwarder for the Sandbox that might be helpful. There is a note specifically for Windows forwarders at the very bottom of the answer. Not sure if that's part of the issue you're experiencing, but worth checking out. http://answers.splunk.com/answers/214420/how-do-i-setup-a-splunk-cloud-trial-sandbox-forwar.html

Get Updates on the Splunk Community!

Build Your First SPL2 App!

Watch the recording now!.Do you want to SPL™, too? SPL2, Splunk's next-generation data search and preparation ...

Exporting Splunk Apps

Join us on Monday, October 21 at 11 am PT | 2 pm ET!With the app export functionality, app developers and ...

[Coming Soon] Splunk Observability Cloud - Enhanced navigation with a modern look and ...

We are excited to introduce our enhanced UI that brings together AppDynamics and Splunk Observability. This is ...