Getting Data In

splunk cloud, universal forwarder no data in

guidovbrakel
New Member

I have setup splunk cloud yesterday and installed a universal forwarder on both linux (centos) and windows (windows server 2012 r2), but no data is getting into my splunk cloud "instance". please help.

I do have some active forwards
[root@server bin]# ./splunk list forward-server
Active forwards:
input-prd-p-g6lslmzlhtlt.cloud.splunk.com:9997 (ssl)
Configured but inactive forwards:
None

Tags (1)
0 Karma

hortonew
Builder

Did you already verify the connectivity from universal forwarder to indexer (e.g. telnet input-prd-p-g6lslmzlhtlt.cloud.splunk.com 9997, or cat < /dev/tcp/input-prd-p-g6lslmzlhtlt.cloud.splunk.com/9997) ? When you say no data is getting there, did you 1) set up some inputs or 2) check if _internal has any data in it from remote hosts?

0 Karma
Get Updates on the Splunk Community!

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...

Index This | What goes away as soon as you talk about it?

May 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...

What's New in Splunk Observability Cloud and Splunk AppDynamics - May 2025

This month, we’re delivering several new innovations in Splunk Observability Cloud and Splunk AppDynamics ...