universalforwarders in centos7

[Shakeer_Spl]

Dear All,

Unable to send data from universal forwarder, to Splunk Enterprise i have minimal knowledge in Splunk  I'm trying to configure universal forwarder but unable to success could you please help me in this regards

Please find the below my configurations

i am using Splunk Enterprise 9.0 and universal forwarder version 9.1.1using Cent OS 7.0

inputs.conf

[root@Universalforwarders local]#

[monitor:///var/log/messages]

index=os

disabled=0

outputs.conf

[root@Universalforwarders local]#

[tcpout]

defaultGroup = default-autolb-group

[tcpout:default-autolb-group]

[server://192.168.122.1:9997]

i used following command to check port status: netstat -an | grep 9997

tcp     0     0   0.0.0.0:9997   0.0.0.0:*   LISTEN

localhost.localdomain --- my Splunk enterprise instance

127.0.0.1 --- my Splunk Universal forwarder

i want to know where i am doing mistake

would be appreciate your kind support

thanks in advance

[richgalloway]

Are Splunk Enterprise and the Universal Forwarder (UF) running on the same server.  If so, it's unnecessary and can lead to problems.  Remove the UF since Splunk Enterprise is fully capable of monitoring files without it.

If they are on separate servers then confirm there is no firewall blocking connections between them.

Check the logs on the UF (/opt/splunkforwarder/var/log/splunk/splunkd.log) to see if there are any messages that might explain why data is not being sent to Splunk

Finally, neither Splunk Enterprise nor Universal Forwarder should run as root because that creates a security risk.

[Shakeer_Spl]

thanks, for your support

After i reinstalled UF it's started work..

my issue has been fixed