Getting Data In

Why is Splunk Universal Forwarder on AWS not showing up in the list of forwarders in my Cloud instance?


I am new to Splunk and I am trying to test Splunk Cloud with my AWS instance. I have a forwarder built in AWS.
It does not show up in the forwarders of my cloud instance

It installs fine according to the instructions provided. I have installed using the .spl file and a local admin account. I restarted Splunk using the CLI. no errors were encountered - here is the output

PS C:\Program
.\splunk.exe restart SplunkForwarder:

Splunk> Like an F-18, bro.

Checking prerequisites...
Checking mgmt port [8089]: open
Checking conf files for problems...
Checking default conf files for edits...
Validating installed files against hashes from 'C:\Program
All installed files intact.
Done All preliminary checks passed.

Starting splunk server daemon

SplunkForwarder: Starting (pid 2200)

The forwarder has internet access, and Windows firewall has been disabled.
I have added a syslog listener to the forwarder using Splunk add udp 514 -sourcetype syslog

I have confirmed that data is getting to the forwarder using wireshark but I don't see data being forwarded out

how can I determine what the issue is?


0 Karma

Splunk Employee
Splunk Employee

Since you have the Cloud Forwarder app installed from your Splunk Cloud instance, your host should be sending data to Splunk Cloud.

First run the following search

index=_internal | stats count by host

Note the hosts sending data to your instance. You should be seeing your "AWS instance" listed there. Is it?

If so, in the forwarder list in the Management Console section, this can take time to populate.


thank you! - There is actual data from my forwarder
The directions led me to believe that I had to configure the forwarder which was not showing up ( and still isnt ) , Ididnt think to check for any data

0 Karma


@esix .. how long should it take for the forwarder to populate in the mgmt console ? been over 12 hours still not there

0 Karma
Get Updates on the Splunk Community!

Admin Your Splunk Cloud, Your Way

Join us to maximize different techniques to best tune Splunk Cloud. In this Tech Enablement, you will get ...

Cloud Platform | Discontinuing support for TLS version 1.0 and 1.1

Overview Transport Layer Security (TLS) is a security communications protocol that lets two computers, ...

New Customer Testimonials

Enterprises of all sizes and across different industries are accelerating cloud adoption by migrating ...