Getting Data In

Windows event logs, Linux server

FloydATC
Explorer

I'm running my trial Splunk indexer on a linux host and already collecting data from switches, VMware hosts, firewalls, SAN and a few other interesting systems.

I have configured "Receiving" on the server to listen on port 9997.

This morning I installed the Universal Forwarder on a Windows 2008 R2 server and selected all the Event Logs for forwarding. TCP ports 8089 and 9997 are open on the server side and I can see TCP traffic using tcpdump. The Windows host appears under "Forwarder Management", Phone Home says "a few seconds ago" so I have every reason to believe the communication is working properly.

However, searching for the IP address or hostname of the Windows shows no matches, neither does any search for strings that appear in the event log as seen using Windows' own event log viewer.

I also chose to forward the contents of a single directory where the backup agent produces its log files. Searching for strings that appear in those log files also comes up empty.

What am I missing?

0 Karma
1 Solution

lukejadamec
Super Champion

Check the splunkd log on the windows system for errors. It is probably best to restart splunk on the windows system, so you can see the inputs initialize in the log.
Also, if you run the restart from the cmd window then you see if there are errors in start up, but the cmd window must be "run as administrator" on w2k8.

View solution in original post

FloydATC
Explorer

Thanks for pointing me in the right direction 🙂 The log file seems to indicate that splunk was quite busy transferring files from the selected directory. Judging from the log, after about 30 minutes or so it appears to have settled down and I can now search the Event Log messages as expected.

0 Karma

lukejadamec
Super Champion

Check the splunkd log on the windows system for errors. It is probably best to restart splunk on the windows system, so you can see the inputs initialize in the log.
Also, if you run the restart from the cmd window then you see if there are errors in start up, but the cmd window must be "run as administrator" on w2k8.

Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...