Please help -
my centos 8 server is show some inactive forwards to my indexer.
[splunk@centos8 ~]$ /opt/splunkforwarder/bin/splunk list forward-server
Active forwards:
10.0.0.42:9997
Configured but inactive forwards:
10.0.0.36:9997
10.0.0.45:9997
[splunk@centos8 ~]$
outputs.conf
[tcpout] defaultGroup = default-autolb-group [tcpout:default-autolb-group] disabled = false server = mysplunkindexer1:9997,mysplunkindexer2:9997
Verify all three indexers are up and accessible (firewalls, etc.).
Check the forwarder's splunkd.log for messages that might explain why the connections failed.