Knowledge Management

Splunk Forwarder Data Verification

kamal2222ahmed
Explorer

I installed Splunk Forwarder on CentOS 7.4 using the following steps:

  1. wget http://xxxxr/Splunk/splunkforwarder-6.6.4-00895e76d346-linux-2.6-x86_64.rpm

Run Splunk as the root user

  1. /opt/splunkforwarder/bin/splunk enable boot-start --accept-license

  2. /opt/splunkforwarder/bin/splunk set deploy-poll a.a.a.a:nnnn

  3. service splunk start

  4. /opt/splunkforwarder/bin/splunk add monitor /var/log

  5. /opt/splunkforwarder/bin/splunk add monitor /opt/splunkforwarder/var/log/splunk

Then i login to Splunk UI, and in the search bar type host=hostname.a.b.c*

I get "No results yet found."

Is there a way to quickly verify that events are being received by Splunk?

Tags (1)
0 Karma

p_gurav
Champion

You have to add server's details where forwarder has to forward data to. You can run below command on forwarder:

/opt/splunk/bin/splunk add forward-server <indexer_ip>:9997

Also open 9997 port on indexer or you splunk instance where you are forwarding data.

kamal2222ahmed
Explorer

I added the forward-server, but still do not see any event. As for opening the port, that port is servicing hundreds if not thousands of hosts, so on the Enterprise Splunk Server, it is open. Is there any troubleshooting that i can do on the node/client end

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...