Splunk Enterprise

Universal forwarder not for forwarding

saotaigiri
Explorer

After installing the universal forwarder on the forwarding host using windows, the splunk enterprise has been able to detect it but it is not sending any logs. Has 0 deployed apps. Please I need help on how to get it to start forwarding logs. Thanks.

Labels (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Does the forwarder have inputs defined and enabled?  Has the forwarder written any error messages into its splunkd.log file?

---
If this reply helps you, an upvote would be appreciated.
0 Karma

saotaigiri
Explorer

Does the forwarder have inputs defined and enabled?  Has the forwarder written any error messages into its splunkd.log file?

 

Please I'm not too sure what you are asking, I installed the forwarder the normal way via windows, put in the splunk id and PW, put in a deployment server IP with the normal port 8089, the indexer @ 9997 and finished the installation. Not sure what I did wrong. Please help I'm a novice.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Do you have a deployment server configured in your Splunk environment?  If not, then the forwarder will not have any configurations and so will not know what to monitor.

The fix is to re-install the forwarder and skip the part about the deployment server.  The installer will then ask you what inputs you want to enable.

---
If this reply helps you, an upvote would be appreciated.
0 Karma