i am using fc9 webservers my server pool 192.168.0.0/24 i crated one splunk centralized server i integrated all client servers but i cont get it my clients in splunk server
i don't know how to create splunk client
pls guide me have i need to install any splunk package in client side
i followed below steps i installed splunk in 192.168..2 cd /opt sudo wget 'http://www.splunk.com/index.php/download_track?file=3.4.8/linux/splunk-3.4.8-54309-Linux-i686.tgz&ac=&wget=true&name=wget&typed=releases' sudo tar xvfz splunk-3.4.6-51113-Linux-i686.tgz sudo splunk/bin/splunk start
sudo /opt/splunk/bin/splunk enable boot-start sudo iptables -A INPUT -s ip.address1.to.allow -p tcp --dport 8000 -j ACCEPT sudo iptables -A INPUT -s ip.address2.to.allow -p tcp --dport 8000 -j ACCEPT sudo iptables -A INPUT -p tcp --dport 8000 -j DROP
in mys client system 192.168.0.23 in mys client system 192.168.0.24 in mys client system 192.168.0.25
i edit in mys client systems /etc/hosts
i restarted network in my clints restarted splunk service in my centralized system /opt/splunk/bin/splunk restart its restarted sucsessfully i got web interface http://ipaddress:8000
i got iostat,user aditlogs information in my splunk server but i dint get my clint information pls guide me how to intigrate my clints with splunk server
thanks in addvance
thanks for your giving documentation but i am new in splunk i installed splun one machine forwarder i installed my remote system i enable receiver im my system but i didn't get the forworder data on my spluk server i didn't understand what is the reason to up my forwarder system in splunk server
pls guide me how to up the splunk forwarder on my splunk server
It sounds like you are trying to set up a splunk indexer, and you'd like to set up forwarders to send data to that indexer, although I am not positive about that based on your description of the issue.
The first thing I noticed is that you are installing a 3.4 version of the product. I would recommend that you install the latest version of Splunk, which is 4.2. You are going to run into many problems that have been resolved since the release of that product.
You can find some useful information on installing here:
Information on settings up forwarding and receiving can be found here, with instructions as to how to configure each piece:
Do you see your splunk forwarder attempting to make connections to your indexer in your splunkd.log in the $SPLUNK_HOME/var/log/splunk folder? That is the first place I would look for a clue as to what is happening. You may also want to look for connection messages related to the forwarder in the same location and same file on the Indexer.