Getting Data In

forwarding question

roshanjan
New Member

Hello,
I want to configure 1 receiver, done! I want to have roughly 10-20 *nix systems sending data using forwarders.
I have some issues, any help is appreciated.

I have a receiver:

hostname is splunk, and it is listening on port 9997 as a receiver
I have a forwarded, let's call it HR.

root@splunk:/opt/splunk# bin/splunk list forward-server
Your session is invalid. Please login.
Splunk username: admin
Password:
Active forwards:
None
Configured but inactive forwards:
hr:8089

root@hr:/opt/splunk# bin/splunk list forward-server
Your session is invalid. Please login.
Splunk username: admin
Password:
Active forwards:
None
Configured but inactive forwards:
splunk:9997
root@hris:/opt/splunk#

I am getting some data in splunk when I search by host="hr", but this host is not automatically added to my Unix app either.

There are also all these errors:
04-16-2012 17:08:19.001 -0400 ERROR TcpInputFd - ACCEPT_RESULT=-1 VERIFY_RESULT=0
04-16-2012 17:08:19.001 -0400 ERROR TcpInputFd - SSL Error for fd from HOST:10.10.10.10, IP:10.10.10.10, PORT:39728
04-16-2012 17:08:19.003 -0400 ERROR TcpInputFd - SSL Error = error:140760FC:SSL routines:SSL23_GET_CLIENT_HELLO:unknown protocol
04-16-2012 17:08:19.003 -0400 ERROR TcpInputFd - ACCEPT_RESULT=-1 VERIFY_RESULT=0
04-16-2012 17:08:19.003 -0400 ERROR TcpInputFd - SSL Error for fd from HOST:10.10.10.10, IP:10.10.10.10, PORT:39729
04-16-2012 17:08:19.003 -0400 ERROR TcpInputFd - SSL Error = error:140760FC:SSL routines:SSL23_GET_CLIENT_HELLO:unknown protocol
04-16-2012 17:08:19.003 -0400 ERROR TcpInputFd - ACCEPT_RESULT=-1 VERIFY_RESULT=0
04-16-2012 17:08:19.003 -0400 ERROR TcpInputFd - SSL Error for fd from HOST:10.10.10.10, IP:10.10.10.10, PORT:39730

Tags (1)
0 Karma

tschramm
New Member

Did you ever find an answer to this? I'm getting the same thing for my redhat clients? Windows clients are fine.

0 Karma
Get Updates on the Splunk Community!

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...