Getting Data In

no forwarder in splunk

Path Finder

I have installed splunk on machine 1 and universal forwarder on machine 2. I can see on forwarder:

C:\Program Files\SplunkUniversalForwarder\bin>splunk list forward-server
Active forwards:
Configured but inactive forwards:

however when i go and check in splunk, i don't see any forwarder details.
the C:\Program Files\Splunk\etc\system\local\inputs.conf is like below.

host = <IP of machine where splunk is installed>
disabled = 0

The outputs.conf on forwarder is like below

defaultGroup = default-autolb-group
server = <receiverIP>:9997

I checked in splunkd logs in forwarder, there is no error corresponding to tcpout.
I am able to telnet on 9997 port from forwarder to receiver

Please advise.

Tags (2)
0 Karma

Path Finder

i reinstallled splunk and forwarder ,a nd it is working now...
seems there was an issue with splunk server configs!!!!! 🙂

0 Karma