I am unable to receive data from the forwarder to the server However I have added the server
on server I got
netstat -auntp | grep 9997
tcp 0 0 0.0.0.0:9997 0.0.0.0:* LISTEN
tcp 0 0 myserver:9997 ServerIP:60992 ESTABLISHED
Hi @AmyShah,
if you're not receiving data from a Forwarder you have at first to check if you did all the configuration steps:
If you did all the above configuration steps, you have to check, if you're receiving logs.
At first check if you're receiving the Splunk internal logs:
index=_internal host=<your_host>
If yes, the problem is that you have to configure inputs (https://docs.splunk.com/Documentation/Splunk/8.1.3/Data/Usingapps) or there's a problem on them.
If not, check again the connection.
Ciao.
Giuseppe