Getting Data In
Highlighted

Why am I unable to establish a connection between the indexer and forwarder?

Explorer

I installed the forwarder on Linux VM and I'm trying to establish a connection between indexer and forwarder, but was unable to do that. When i was trying to start forwarder, the command is not working and don't know why ? - (./splunk start)

0 Karma
Highlighted

Re: Why am I unable to establish a connection between the indexer and forwarder?

SplunkTrust
SplunkTrust

You need to be in the bin directory to start the Splunk forwarder

Go to /opt/splunkforwarder/bin and execute ./splunk start or do it all in a one liner like /opt/splunkforwarder/bin/splunk start

View solution in original post

0 Karma
Highlighted

Re: Why am I unable to establish a connection between the indexer and forwarder?

Explorer

I have done that, i was just checking the status of the splunk and want to try

ping myipaddress --- just want to check the connection between forwarder and indexer

and want to try command---- splunk add forward -server myipaddress:9997

but im stopping at this point itself ..

[user@localhost bin]$ ./splunk start
splunkd 7002 was not running.
Stopping splunk helpers...
[ OK ]
Done.
Stopped helpers.
Removing stale pid file... done.
Splunk> Another one.

Checking prerequisites...
Checking mgmt port [8089]: open
Checking conf files for problems...
Done
Checking default conf files for edits...
Validating installed files against hashes from '/opt/splunkforwarder/splunkforwarder-6.5.2-67571ef4b87d-linux-2.6-x86_64-manifest'
All installed files intact.
Done
All preliminary checks passed.

Starting splunk server daemon (splunkd)...

Done
[ OK ]
[user@localhost bin]$ splunk status
bash: splunk: command not found...

0 Karma
Highlighted

Re: Why am I unable to establish a connection between the indexer and forwarder?

SplunkTrust
SplunkTrust

You're in the bin directory already so the command should look like this..

./splunk status

If you weren't in the bin direcotry then it would look like this

/opt/splunkforwarder/bin/splunk status

0 Karma
Highlighted

Re: Why am I unable to establish a connection between the indexer and forwarder?

Explorer

this helped me ..

0 Karma
Highlighted

Re: Why am I unable to establish a connection between the indexer and forwarder?

SplunkTrust
SplunkTrust

Feel free to upvote if it helped 🙂

0 Karma
Highlighted

Re: Why am I unable to establish a connection between the indexer and forwarder?

SplunkTrust
SplunkTrust

You should also do a telnet from your forwarder to the indexer to verify your not getting blocked by a firewall

Install telnet

sudo yum install telnet

Once installed run this

telnet INDEXER_IP 9997

It should successfully connect

0 Karma
Highlighted

Re: Why am I unable to establish a connection between the indexer and forwarder?

Explorer

Im getting this error while trying to run that command :

[user@localhost bin]$ sudo yum install telnet
[sudo] password for user :
Loaded plugins: langpacks, product-id, search-disabled-repos, subscription-
: manager
This system is not registered to Red Hat Subscription Management. You can use subscription-manager to register.
There are no enabled repos.
Run "yum repolist all" to see the repos you have.
You can enable repos with yum-config-manager --enable

0 Karma
Highlighted

Re: Why am I unable to establish a connection between the indexer and forwarder?

Explorer

[user@localhost bin]$ yum repolist all
Loaded plugins: langpacks, product-id, search-disabled-repos, subscription-
: manager
repolist: 0

0 Karma
Highlighted

Re: Why am I unable to establish a connection between the indexer and forwarder?

SplunkTrust
SplunkTrust

This is more of a RHEL issue than Splunk, but it looks like you have a bad date or time on your system. You may also not have the subscription registered

What do you get when you run ./splunk status while in the /opt/splunkforwarder/bin directory?

0 Karma