Getting Data In

Why are Apache access logs not appearing after configuration and ogs show the server is rejecting the connection between itself?

Spiere
Path Finder

Hey guys,

I have configured the forwarder to send apache access logs to itself from localhost. However, when I look at the metrics log for Splunk, I see

01-07-2016 19:34:57.279 +0000 INFO  StatusMgr - destHost=xx.xx.xxx.xxx, destIp=xx.xx.xxx.xxx, destPort=9997, eventType=connect_try, publisher=tcpout, sourcePort=8089, statusee=TcpOutputProcessor
01-07-2016 19:34:57.280 +0000 INFO  StatusMgr - destHost=xx.xx.xxx.xxx, destIp=xx.xx.xxx.xxx, destPort=9997, eventType=connect_fail, publisher=tcpout, sourcePort=8089, statusee=TcpOutputProcessor

My inputs.conf file is inside of /opt/splunk/etc/apps/search/local/inputs.conf, and it says -

[splunktcp://9997]
connection_host = ip

[monitor:///var/log/apache2/access.log]
disabled = false
index = main
sourcetype = access_combined

I'm pretty sure I already opened port 9997. When I do it inside of Splunk, it says the port is already open.

Any help would be appreciated.

Thanks

0 Karma
1 Solution

Spiere
Path Finder

The issue was that the forwarder and the receiver were on the same server, so it was causing a feedback loop and not allowing and new indexes to be processed. Removing the forwarder and all of the configuration relating to it from the server that the receiver was on fixed the issue.

View solution in original post

0 Karma

Spiere
Path Finder

The issue was that the forwarder and the receiver were on the same server, so it was causing a feedback loop and not allowing and new indexes to be processed. Removing the forwarder and all of the configuration relating to it from the server that the receiver was on fixed the issue.

0 Karma
Get Updates on the Splunk Community!

Your Guide to SPL2 at .conf24!

So, you’re headed to .conf24? You’re in for a good time. Las Vegas weather is just *chef’s kiss* beautiful in ...

Get ready to show some Splunk Certification swagger at .conf24!

Dive into the deep end of data by earning a Splunk Certification at .conf24. We're enticing you again this ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Now On-Demand Join us to learn more about how you can leverage Service Level Objectives (SLOs) and the new ...