I currently have a UniversalForwarder running on a linux syslog server with a bunch of file monitors in place such as: [monitor:///var/log/10.10.10.99/syslog.log]index=hphost_segment=3disabled=0 The...
Most of the time, we are seeing that the Splunk universalforwarder or heavy forwarder is failing to forward data to the indexer. In this scenario, what troubleshooting steps should we take to i...
How can I troubleshootthe deployment server or universal or heavy forwarder?
I set up deployment server then in forwarders I run ./splunk set deploy-poll ip:port
But Forwarder M...
Hello Community,
I am having issues connecting my UniversalForwarder with a Heavy Forwarder.
I have the following set up: UF-->HF-->IDx
I can see the logs from HF to IDx, but not sure w...
I'm having some issues getting UniversalForwarders to talk to the Deployment Server, and I'm looking for some troubleshooting pointers. Here's the scenario, pretty basic setup.
Splunk E...
Hi All,
We are using Splunk Cloud and have a UniversalForwarder setup on a windows machine - it reads CSV files from a particular folder and sends to indexer.
inputs.conf:
&n...
I've tried to enable boot-start on *nix and Windows, but after the machine reboots, Splunk Forwarder still cannot start automatically. Can anyone have solutions for this case?
When I try to add my indexer to the configuration of my linux box where I have installed theuniversalforwarder, it errors on authentication.
This is on Splunk 5.0, and the Splunk server (i...
I'm facing 1 issue when try to install a Splunk universalforwarder in one of my job sites. Every time when I change its connection to 127.0.0.1 51112, it will fail after 3 minutes of waiting and r...
...erfectly, except that my UniversalForwarder on the Deployment client doesn't use the outputs.conf from the "sendtoindexer" app...
The outputs.conf file is in the folder
When I'am l...