inactive receiver

[holgersson]

So, I got the classic problem of not being able to push data from my forwarder to my receiver.

Things that I've already tried:

• check that the port is available and useable by chatting with myself via nc (nc -l 14000 on my receiver, nc $IP 14000 on my sender)
• reinstalled the receiver because why not
• nearly every fix I could find on this forum that did not involve the firewall, because the port obviously was available

My outputs.conf looks as follows

[tcpout]
defaultGroup = default-autolb-group

[tcpout:default-autolb-group]
server = ##.##.##.##:14000

[tcpout-server://##.###.###.##:14000]

and the inputs.conf on my receiver

[default]
host = host-linux

[splunktcp://14000]

I've tried adding an index-tag to my receivers inputs but to no avail. Also, I'm totally inexperienced with Splunk and wanted to try to make my first steps with my current setup, but obviously did not have any luck yet.

[holgersson]

I should probably add that when I stopped Splunk on my receiver and instead went for nc -l 14000, there were cooked Splunk messages, so my forwarder seems to even try to establish a connection but is getting ignored by my receiver.