Installed universal forwarder in windows. Checked the splunkd log and I could see the connection to server without any error as below. tried checking with firewall and ports.But still index doesnt log any events.
TcpOutputProc - Connected to idx=xxxx:9997.
Below are my conf file.
inputs.conf
[default]
host = xxxxx
[monitor:C:\opt\splunk\]
disabled = false
sourcetype = hievents
index = hiindex
Outputs.conf
[tcpout]
defaultGroup = default-autolb-group
[tcpout:default-autolb-group]
server = xxxx:9997
[tcpout-server://xxxx:9997]
Please advice.
Please check for monitor syntax: [monitor://
Hi skumarvs,
here are some typical troubleshooting tips:
index=hiindex
?index=_internal source=*splunkd.log
on the indexer for any error related to the universal forwarderLast but not least do the usual troubleshooting around Splunk, is everything doing what it should do and so on.
hope this helps ...
cheers, MuS