Splunk Enterprise integration with Universal forwarder

[13011994]

Hi Team,

We are running Splunk Enterprise 6.4.1 in windows machine .We are able to monitor local system logs and applications.

But we need to monitor remote windows machine. So we installed universal forwarder 5.0 in another machine and gave the following settings

1) Added forwarder server with port 9997 in Universal forwarder
2)Enabled receiver on 9997 port on Splunk Enterprise

After giving this configuration when we list the forwarder- server in universal forwarder we are getting
C:\Program Files\SplunkUniversalForwarder\bin>splunk.exe list forward-server
Active forwards:
None
Configured but inactive forwards:
receiving host:9997

Plz let us know to debug this issue

[lguinn2]

As @richgalloway said: "Why use such an old Universal Forwarder?" Also, any 6.x forwarder has major performance and feature improvements over version 5.x forwarders.

But I suspect that the actual problem is in the outputs.conf file on the forwarder OR that the network route between the forwarder and the indexer is blocked in some way. Check the splunkd.log on the forwarder; you will find it under the forwarder's installation directory at var/log/splunk. In splunkd.log, you should see whether the forwarder is able to connect to the indexer. The splunkd.log will also show if Splunk has problems reading the input files, etc.

[13011994]

Hi Iguinn,

I am getting the below error. Can u say how to resolve this issue?

+0530 WARN TcpOutputProc - Cooked connection to ip=dest ip address:9997 timed out
+0530 WARN DeploymentClient - Unable to send handshake message to deployment server. Error status is: not_connected
+0530 WARN DeploymentClient - Unable to send handshake message to deployment server. Error status is: not_connected
+0530 WARN DeploymentClient - Unable to send handshake message to deployment server. Error status is: not_connected
+0530 WARN TcpOutputProc - Cooked connection to ip=dest ip address:9997 timed out

Regards,
Udhaya

[richgalloway]

Which version of UF is reporting the errors?
Verify the IP address matches that of your deployment server. If you don't have a deployment server, modify your config to have the UF send data directly to indexers.

[richgalloway]

Why are you using such an old Universal Forwarder? Major version numbers should match between UF and Splunk core. Try installing a 6.4.x UF.