- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
splunk cloud, universal forwarder no data in
guidovbrakel
New Member
05-17-2018
02:31 AM
I have setup splunk cloud yesterday and installed a universal forwarder on both linux (centos) and windows (windows server 2012 r2), but no data is getting into my splunk cloud "instance". please help.
I do have some active forwards
[root@server bin]# ./splunk list forward-server
Active forwards:
input-prd-p-g6lslmzlhtlt.cloud.splunk.com:9997 (ssl)
Configured but inactive forwards:
None
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

hortonew
Builder
05-18-2018
08:45 PM
Did you already verify the connectivity from universal forwarder to indexer (e.g. telnet input-prd-p-g6lslmzlhtlt.cloud.splunk.com 9997, or cat < /dev/tcp/input-prd-p-g6lslmzlhtlt.cloud.splunk.com/9997) ? When you say no data is getting there, did you 1) set up some inputs or 2) check if _internal has any data in it from remote hosts?
