Need help to configure indexer and forwarder

[chittari]

Need help to configure indexer and forwarder. This what i have done till now.

But somehow i don't see my forwarder machine under "Search" though log file was mentioned in splunkd logs, not sure what is the problem. Please advise or forward it Splunk support if needed. Thanks

Below is the config changes done so far.

1- on indexer side (cfcmslxdev01.lehman.com), splunk web->manager->forwarding and receiving->receive data: add new. Specify a TCP port (I use 9997). Save and restart
2. On Forwarder (server sgppsr00346)

/apps/splunkforwarder/etc/system/local/inputs.conf

[default]
host = sgppsr00346.intranet.barcapint.com
[monitor:///home/cetprod/TTV2Container/prod_apem/EMOfferingOverlay/log/*.log]
_TCP_ROUTING = GroupName
disabled=false
index=test

/apps/splunkforwarder/etc/system/local/outputs.conf
[tcpout]
defaultGroup = GroupName
[tcpout:GroupName]
server = 10.56.112.114:9997
[tcpout-server://10.56.112.114:9997]

Please advise, Thanks

[MickSheppard · Accepted solution]

I don't think that this line is needed:

[tcpout-server://10.56.112.114:9997]

If you're forwarding everything from the server you don't need the line:

_TCP_ROUTING = GroupName

When looking for the data in the test index have you checked the following:

1. The user has access to the test index?
2. You are specifying index=test in the search term, or the test index is in the default search for the user you are using?

Its probably better to use a more descriptive name than 'GroupName' for your forwarding group.

[chittari]

Thanks for help. There was typo in index creation. But you guided me to resolve this. Thanks

[Javip]

Thanks a lot!
I had a similar problem.