Getting Data In

inactive receiver

holgersson
New Member

So, I got the classic problem of not being able to push data from my forwarder to my receiver.

Things that I've already tried:

  • check that the port is available and useable by chatting with myself via nc (nc -l 14000 on my receiver, nc $IP 14000 on my sender)
  • reinstalled the receiver because why not
  • nearly every fix I could find on this forum that did not involve the firewall, because the port obviously was available

My outputs.conf looks as follows

[tcpout]
defaultGroup = default-autolb-group

[tcpout:default-autolb-group]
server = ##.##.##.##:14000

[tcpout-server://##.###.###.##:14000]

and the inputs.conf on my receiver

[default]
host = host-linux

[splunktcp://14000]

I've tried adding an index-tag to my receivers inputs but to no avail. Also, I'm totally inexperienced with Splunk and wanted to try to make my first steps with my current setup, but obviously did not have any luck yet.

0 Karma

holgersson
New Member

I should probably add that when I stopped Splunk on my receiver and instead went for nc -l 14000, there were cooked Splunk messages, so my forwarder seems to even try to establish a connection but is getting ignored by my receiver.

0 Karma
Get Updates on the Splunk Community!

Security Highlights: September 2022 Newsletter

 September 2022 The Splunk App for Fraud Analytics (SFA) is now Splunk SupportedUse your existing Splunk ...

Platform Highlights | September 2022 Newsletter

 September 2022 What’s New in 9.0 and How to UpgradeGet a walk through of what is new Splunk Enterprise 9.0 ...

Observability Highlights | September 2022 Newsletter

 September 2022 Splunk Observability SuiteAccess to "Classic" SignalFx Interface Will be Removed on Sept 30, ...