Splunk Enterprise

Why does the splunk lite universal forwarder not show up in de forwarders list?

DBoom
New Member

I have build a cloud infrastructure in azure with a windows server with a windows server. Next i've installed the splunk lite on my pc.
On the windows server iv'e installed the universal forwarder, but i cannot find it in my splunk lite console.

0 Karma

gneumann_splunk
Splunk Employee
Splunk Employee

Be sure you have followed the steps for installing the universal forwarder on Microsoft Windows. See
http://docs.splunk.com/Documentation/SplunkLight/6.5.2/GettingStarted/GettingdataintoSplunkLightusin...

Note, if using the installation wizard, be sure to configure the Deployment Server dialog (port 8089), and the Receiving Indexer dialog (port 9997).

If using the command line, see http://docs.splunk.com/Documentation/Forwarder/6.5.2/Forwarder/InstallaWindowsuniversalforwarderfrom... and be sure to flag:
RECEIVING_INDEXER="" and DEPLOYMENT_SERVER=""

You should be able to see your forwarders on the System > Forwarder management page in Splunk Light.

0 Karma

ronekarleone
Explorer

Hi!

First, you should check connectivity behind Splunk and UF (universal forwarder). So try to ping your Splunk Lite from Server with UF (turn off windows firewall for check). Try use telnet to port 8080 using Putty or Windows's telnet utility. May be firewall block your traffic, or you haven't right routes. You can see all needed ports on this diagram https://answers.splunk.com/answers/118859/diagram-of-splunk-common-network-ports.html

Second, check splunkd.log for errors on server with UF. Also you can check log files on Splunk Lite.

Please, let me know about the results.

0 Karma

varad_joshi
Communicator

On the UF have you configured outputs.conf file to forward the data??

Please ensure you have inputs.conf and outputs.conf configured and your Splunk server is ready to receive the logs.

0 Karma
Get Updates on the Splunk Community!

Get Inspired! We’ve Got Validation that Your Hard Work is Paying Off

We love our Splunk Community and want you to feel inspired by all your hard work! Eric Fusilero, our VP of ...

What's New in Splunk Enterprise 9.4: Features to Power Your Digital Resilience

Hey Splunky People! We are excited to share the latest updates in Splunk Enterprise 9.4. In this release we ...

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...