- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
After installing the universal forwarder on the forwarding host using windows, the splunk enterprise has been able to detect it but it is not sending any logs. Has 0 deployed apps. Please I need help on how to get it to start forwarding logs. Thanks.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Does the forwarder have inputs defined and enabled? Has the forwarder written any error messages into its splunkd.log file?
Please I'm not too sure what you are asking, I installed the forwarder the normal way via windows, put in the splunk id and PW, put in a deployment server IP with the normal port 8089, the indexer @ 9997 and finished the installation. Not sure what I did wrong. Please help I'm a novice.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Does the forwarder have inputs defined and enabled? Has the forwarder written any error messages into its splunkd.log file?
If this reply helps you, Karma would be appreciated.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Does the forwarder have inputs defined and enabled? Has the forwarder written any error messages into its splunkd.log file?
Please I'm not too sure what you are asking, I installed the forwarder the normal way via windows, put in the splunk id and PW, put in a deployment server IP with the normal port 8089, the indexer @ 9997 and finished the installation. Not sure what I did wrong. Please help I'm a novice.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Do you have a deployment server configured in your Splunk environment? If not, then the forwarder will not have any configurations and so will not know what to monitor.
The fix is to re-install the forwarder and skip the part about the deployment server. The installer will then ask you what inputs you want to enable.
If this reply helps you, Karma would be appreciated.
