Getting Data In

Windows Universal Forwarder Not Forwarding to Indexer

jbruce506
Explorer

This is a new Splunk deployment using a single instance to serve as Indexer, Search Head, and Deployment Server. We used certificates signed by our internal CA to configure SSL data forwarding, however, I am not seeing any of the expected Windows logs being forwarded to the Indexer. Looking at the splunkd log on the Indexer, it returns the error, "Socket error from FORWARDER while idling: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown" I tried to diagnose using btool, but I'm not sure what I'm looking for.

0 Karma
1 Solution

jbruce506
Explorer

Turns out that a default input file was being generated during the UF installation that was screwing up my actual inputs for data collection. Once I deleted that file things began working appropriately, albeit with the default certificates.

View solution in original post

0 Karma

jbruce506
Explorer

Turns out that a default input file was being generated during the UF installation that was screwing up my actual inputs for data collection. Once I deleted that file things began working appropriately, albeit with the default certificates.

0 Karma

jarizeloyola
Path Finder

Have you check the connection between the forwarder and indexer?
you can run openssl command in splunk/bin to test the certificates if it can get through to the indexer.
Check the metrics.log too.

0 Karma

jbruce506
Explorer

I've verified that the ports are open between the forwarder & indexer. When I tested the SSL certificate it just returned that a self-signed certificate was in the chain, I don't think it was an error per se.

I was finally able to see some traffic within the metrics log, but only after I reverted back to the original default SSL certificates. The problem is, 1) the default SSL certificates are not secure and 2) I'm still not see any data forwarded from other inputs that I've deployed via Splunk_TA_windows.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...