Getting Data In

inactive receiver

holgersson
New Member

So, I got the classic problem of not being able to push data from my forwarder to my receiver.

Things that I've already tried:

  • check that the port is available and useable by chatting with myself via nc (nc -l 14000 on my receiver, nc $IP 14000 on my sender)
  • reinstalled the receiver because why not
  • nearly every fix I could find on this forum that did not involve the firewall, because the port obviously was available

My outputs.conf looks as follows

[tcpout]
defaultGroup = default-autolb-group

[tcpout:default-autolb-group]
server = ##.##.##.##:14000

[tcpout-server://##.###.###.##:14000]

and the inputs.conf on my receiver

[default]
host = host-linux

[splunktcp://14000]

I've tried adding an index-tag to my receivers inputs but to no avail. Also, I'm totally inexperienced with Splunk and wanted to try to make my first steps with my current setup, but obviously did not have any luck yet.

0 Karma

holgersson
New Member

I should probably add that when I stopped Splunk on my receiver and instead went for nc -l 14000, there were cooked Splunk messages, so my forwarder seems to even try to establish a connection but is getting ignored by my receiver.

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...

Announcing the 1st Round Champion’s Tribute Winners of the Great Resilience Quest

We are happy to announce the 20 lucky questers who are selected to be the first round of Champion's Tribute ...

We’ve Got Education Validation!

Are you feeling it? All the career-boosting benefits of up-skilling with Splunk? It’s not just a feeling, it's ...