Hello,
I want to configure 1 receiver, done! I want to have roughly 10-20 *nix systems sending data using forwarders.
I have some issues, any help is appreciated.
I have a receiver:
hostname is splunk, and it is listening on port 9997 as a receiver
I have a forwarded, let's call it HR.
root@splunk:/opt/splunk# bin/splunk list forward-server
Your session is invalid. Please login.
Splunk username: admin
Password:
Active forwards:
None
Configured but inactive forwards:
hr:8089
root@hr:/opt/splunk# bin/splunk list forward-server
Your session is invalid. Please login.
Splunk username: admin
Password:
Active forwards:
None
Configured but inactive forwards:
splunk:9997
root@hris:/opt/splunk#
I am getting some data in splunk when I search by host="hr", but this host is not automatically added to my Unix app either.
There are also all these errors:
04-16-2012 17:08:19.001 -0400 ERROR TcpInputFd - ACCEPT_RESULT=-1 VERIFY_RESULT=0
04-16-2012 17:08:19.001 -0400 ERROR TcpInputFd - SSL Error for fd from HOST:10.10.10.10, IP:10.10.10.10, PORT:39728
04-16-2012 17:08:19.003 -0400 ERROR TcpInputFd - SSL Error = error:140760FC:SSL routines:SSL23_GET_CLIENT_HELLO:unknown protocol
04-16-2012 17:08:19.003 -0400 ERROR TcpInputFd - ACCEPT_RESULT=-1 VERIFY_RESULT=0
04-16-2012 17:08:19.003 -0400 ERROR TcpInputFd - SSL Error for fd from HOST:10.10.10.10, IP:10.10.10.10, PORT:39729
04-16-2012 17:08:19.003 -0400 ERROR TcpInputFd - SSL Error = error:140760FC:SSL routines:SSL23_GET_CLIENT_HELLO:unknown protocol
04-16-2012 17:08:19.003 -0400 ERROR TcpInputFd - ACCEPT_RESULT=-1 VERIFY_RESULT=0
04-16-2012 17:08:19.003 -0400 ERROR TcpInputFd - SSL Error for fd from HOST:10.10.10.10, IP:10.10.10.10, PORT:39730
