Getting Data In

Why are we unable to send collection logs on Universal forwarder to both old and new indexers?

OMohi
Path Finder

Hi

we have a client who wants to migrate sending network devices logs from his universal forwarder server from his POC (search head + indexer) servers to our prod indexers.

But when I point the name of the prod indexers on outputs.conf file under /opt/splunkforwarder/etc/system/local/outputs.conf:

outputs.conf:
[tcpout:indexers] 
server=193.91.168.181:9997,205.145.98.20:9997 

[tcpout] 
defaultGroup=s05 

[tcpout:S05] 
server=LOUWEBWPL20S02:9997,LOUWEBWPL20S03:9997 

autoLB = true 
autoLBFrequency = 31 
forceTimebasedAutoLB = true 
useACK = true

The log collection stops on the orginal POC servers as well as on new indexers there is no data coming.

What am I missing here?

My prod indexer servers are :

LOUXXXWPLXXS02:9997
LOUXXXWPLXXS03:9997

and their POC indexer servers are :

190.XX.XXX.XXX:9997,202.XXX.XXX.XX:9997

Why am I unable to do load balancing?

Thanks,

Mohammed 

0 Karma
1 Solution

jayannah
Builder

Hi

The below change should work for you. I have made 2 corrections.
1. S05 ==> s05 (Upper case 'S' to lower case 'S')
2. defaultGroup=s05 ==> defaultGroup=s05, indexers (This is required to send the same data to both set of indexers)

check and let me know.

               outputs.conf:

                [tcpout] 
                defaultGroup=s05, indexers 

                [tcpout:indexers] 
                server=193.91.168.181:9997,205.145.98.20:9997 

                [tcpout:s05] 
                server=LOUWEBWPL20S02:9997,LOUWEBWPL20S03:9997 
                autoLB = true 
                autoLBFrequency = 31 
                forceTimebasedAutoLB = true 
                useACK = true

=====
Above configuration will work, Incase if the above configuration doesn't work, the check the following
1. User IP address for servers incase if DNS resolution creates problem due to firewall
2. Ensure there are no firewall restrictions
3. Ensure port 9997 opens on indexed (receiver side)

View solution in original post

jayannah
Builder

Hi

The below change should work for you. I have made 2 corrections.
1. S05 ==> s05 (Upper case 'S' to lower case 'S')
2. defaultGroup=s05 ==> defaultGroup=s05, indexers (This is required to send the same data to both set of indexers)

check and let me know.

               outputs.conf:

                [tcpout] 
                defaultGroup=s05, indexers 

                [tcpout:indexers] 
                server=193.91.168.181:9997,205.145.98.20:9997 

                [tcpout:s05] 
                server=LOUWEBWPL20S02:9997,LOUWEBWPL20S03:9997 
                autoLB = true 
                autoLBFrequency = 31 
                forceTimebasedAutoLB = true 
                useACK = true

=====
Above configuration will work, Incase if the above configuration doesn't work, the check the following
1. User IP address for servers incase if DNS resolution creates problem due to firewall
2. Ensure there are no firewall restrictions
3. Ensure port 9997 opens on indexed (receiver side)

OMohi
Path Finder

Thanks for your time on investigating this issue. You were right on. I forgot to mention two target group as my default group. Also there was a typo in one of the default group S for s.

This assisted me in troubleshooting the matter.

Thanks Again !!

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...