Getting Data In

inactive receiver

holgersson
New Member

So, I got the classic problem of not being able to push data from my forwarder to my receiver.

Things that I've already tried:

  • check that the port is available and useable by chatting with myself via nc (nc -l 14000 on my receiver, nc $IP 14000 on my sender)
  • reinstalled the receiver because why not
  • nearly every fix I could find on this forum that did not involve the firewall, because the port obviously was available

My outputs.conf looks as follows

[tcpout]
defaultGroup = default-autolb-group

[tcpout:default-autolb-group]
server = ##.##.##.##:14000

[tcpout-server://##.###.###.##:14000]

and the inputs.conf on my receiver

[default]
host = host-linux

[splunktcp://14000]

I've tried adding an index-tag to my receivers inputs but to no avail. Also, I'm totally inexperienced with Splunk and wanted to try to make my first steps with my current setup, but obviously did not have any luck yet.

0 Karma

holgersson
New Member

I should probably add that when I stopped Splunk on my receiver and instead went for nc -l 14000, there were cooked Splunk messages, so my forwarder seems to even try to establish a connection but is getting ignored by my receiver.

0 Karma
Get Updates on the Splunk Community!

What's New in Splunk Observability Cloud and Splunk AppDynamics - May 2025

This month, we’re delivering several new innovations in Splunk Observability Cloud and Splunk AppDynamics ...

Getting Started with Splunk Artificial Intelligence, Insights for Nonprofits, and ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Splunk Observability Cloud’s AI Assistant in Action Series: Identifying Unknown ...

Agentic AI powers the Splunk AI Assistant within the Splunk Observability Cloud interface to help you quickly ...