Getting Data In

Why am I unable to get data from the forwarder to the Splunk application?

sapq
New Member

Hi Team,

I have installed the 6.4.3 version of the universal forwarder on a Windows server 2012. But i am unable to get the server data from the forwarder to the Spunk application.

Below are the details of the data present in the three configuration files.

output.conf
[tcpout]
default=autolb-group
[tcpout-server://gmwcnappv00586.gdc0.chevron.net:9997]

inputs.conf
[default]
host = gmwcnappv00150

[script://$SPLUNK_HOME\bin\scripts\splunk-wmi.path]
disabled = 0

I need the data from the forwarder server gmwcnappv00586 to be reflected in the splunk application server gmwcnappv00150
Kindly let me know the comment as earliest

Thanks
Sanket Panchal

0 Karma

skalliger
SplunkTrust
SplunkTrust

Hi,

you're missing an inputs.conf stanza for a Universal Forwarder sending to your indexer.
Something like this:

 [splunktcp:9997]
 compressed = true
 disabled = 0
 connection_host = none

You could also write:

[splunktcp://gmwcnappv00150:9997]

if gmwcnappv00150 is your UF.

Did that help?

Skalli

Edit: typo

0 Karma
Get Updates on the Splunk Community!

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...