Why am I Not receiving data on indexer (Splunk Enterprise trial license)?

[splunk_learn]

Hi,

I have setup an environment to learn at home. I have 2 instances, one serving as a Splunk Forwarder where I have my data and the other serving as Deployment Server + indexer + search head.

I configured the serverclass and the app, however I'm not getting data into the index from the forwarder even tho I checked the logs in the latter and the connection is successful.

Is it because of the trial license? Any thoughts why is it not working as expected?

Any info would be appreciated. Thanks.

[gcusello]

Hi @splunk_learn,

you cannot use two Splunk instances because they have the same IP address and hostname.

use two virtual machines.

A trial license is a full feature license, so the issue isn't the license.

Ciao.

Giuseppe

[isoutamo]

Hi
Actually you can but you shouldn't 😉
Just "play" with port numbers on conf files and use tar package and install those on separate directories. This is doable on lab env, but never do this on production.
But you shouldn't start your Splunk career with this kind of hack. Just use enough VM's etc.
r. Ismo

[splunk_learn]

Hi @gcusello,

I setup 2 vms one is a Splunk Enterprise instance and the other is the Universal forwarder.

I was able to figure it out I had something wrong in my inputs.conf in the forwarder.

Thank you for clarifying me regarding the trial license as I had that doubt.

Cheers.

[gcusello]

Hi @splunk_learn,

good for you, see next time!

let me know if I can help you more, or, please, accept one answer for the other people of Community.

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉