Splunk Enterprise

Universal forwarder not for forwarding

saotaigiri
Path Finder

After installing the universal forwarder on the forwarding host using windows, the splunk enterprise has been able to detect it but it is not sending any logs. Has 0 deployed apps. Please I need help on how to get it to start forwarding logs. Thanks.

Labels (1)
0 Karma
1 Solution

saotaigiri
Path Finder

Does the forwarder have inputs defined and enabled?  Has the forwarder written any error messages into its splunkd.log file?

 

Please I'm not too sure what you are asking, I installed the forwarder the normal way via windows, put in the splunk id and PW, put in a deployment server IP with the normal port 8089, the indexer @ 9997 and finished the installation. Not sure what I did wrong. Please help I'm a novice.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Does the forwarder have inputs defined and enabled?  Has the forwarder written any error messages into its splunkd.log file?

---
If this reply helps you, Karma would be appreciated.
0 Karma

saotaigiri
Path Finder

Does the forwarder have inputs defined and enabled?  Has the forwarder written any error messages into its splunkd.log file?

 

Please I'm not too sure what you are asking, I installed the forwarder the normal way via windows, put in the splunk id and PW, put in a deployment server IP with the normal port 8089, the indexer @ 9997 and finished the installation. Not sure what I did wrong. Please help I'm a novice.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Do you have a deployment server configured in your Splunk environment?  If not, then the forwarder will not have any configurations and so will not know what to monitor.

The fix is to re-install the forwarder and skip the part about the deployment server.  The installer will then ask you what inputs you want to enable.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Synthetic Monitoring: Not your Grandma’s Polyester! Tech Talk: DevOps Edition

Register today and join TekStream on Tuesday, February 28 at 11am PT/2pm ET for a demonstration of Splunk ...

Instrumenting Java Websocket Messaging

Instrumenting Java Websocket MessagingThis article is a code-based discussion of passing OpenTelemetry trace ...

Announcing General Availability of Splunk Incident Intelligence!

Digital transformation is real! Across industries, companies big and small are going through rapid digital ...