Forwarding logs from server to local system

[vijay_n]

Hi, 

I have installed universal forwarder in a cloud instance(linux),  then I installed splunk enterprise in my local machine(laptop) which is running win 10. I want to forward logs from linux machine to my laptop's splunk's indexer.

The problem is , what server IP should I be given in Linux universal forwarder/etc/system/local/outputs.conf

[tcpout:example]

server=?????

I tried giving my IP ***.***.**.*** :9997, but there is no use.

In my laptop, the splunk is running at localhost:8000.

Please help me with this.

Thanks.

[PickleRick]

Splunk server is like any other network service daemon. To connect forwarder to receiver (indexer) you need to have the network level visibility like with any other service (web server for example).

So if you can't do that on your own, get some local help with your network setup. There are so many different scenarios that we can't help you get a good advice without detailed knowledge of your networking environment.

Just remember that exposing your laptop services directly to open internet might not be the best idea unless you know really well what you're doing.

[vijay_n]

Thank you for the information.

[VatsalJagani]

You have to give the public IP of your laptop. And make sure the 9997 port of your laptop should be accessible publicly.

Though you are doing stuff on the public internet you have to take security measures like allowed IPs, SSL, etc.

[vijay_n]

HI, I tried adding the firewall rules by allowing tcp for 8000 and 9997, but it didn't helped.

[VatsalJagani]

Try checking with telnet to see if the network is okay or not.

Make sure you have enabled data receiving on the indexers.