Getting Data In

Why is our universal forwarder not visible in the Forwarder Management console?

arandi
Explorer

I have completed the universal forwarder setup, and configured it as a deployment client of the Cloud Instance. But, I'm still not able to view the forwarder in the Forwarder Management console.

I have checked firewall rules for outbound traffic, and it is going trough the required ports.

0 Karma
1 Solution

marycordova
SplunkTrust
SplunkTrust

Check if the below helps:

  1. verify the hostname in /opt/splunk/etc/system/local/inputs.conf
  2. delete /opt/splunk/etc/instance.fcg
  3. restart the forwarder
@marycordova

View solution in original post

marycordova
SplunkTrust
SplunkTrust

Check if the below helps:

  1. verify the hostname in /opt/splunk/etc/system/local/inputs.conf
  2. delete /opt/splunk/etc/instance.fcg
  3. restart the forwarder
@marycordova

arandi
Explorer

Awsome… it worked perfectly.

just a minor correction: the actual directory is under /opt/splunkforwarder/ instead of just /etc/splunk.

but great..

thank you so much

Gabriel

arandi
Explorer

You're awesome... it worked perfectly. just a minor correction here: the actual directory is "/opt/splunkforwarder/" instead of just /etc/splunk, but perfect..

thank you so much..

Get Updates on the Splunk Community!

Detecting Brute Force Account Takeover Fraud with Splunk

This article is the second in a three-part series exploring advanced fraud detection techniques using Splunk. ...

Buttercup Games: Further Dashboarding Techniques (Part 9)

This series of blogs assumes you have already completed the Splunk Enterprise Search Tutorial as it uses the ...

Buttercup Games: Further Dashboarding Techniques (Part 8)

This series of blogs assumes you have already completed the Splunk Enterprise Search Tutorial as it uses the ...