splunk@ebs-xxx:~$ netstat -an| grep 8097 tcp 0 0 0.0.0.0:8097 0.0.0.0:* LISTEN tcp 0 0 172.20.1.50:8097 172.20.1.16:31841 ESTABLISHED OK. This is the trick: "index=airlock" and search. This works! Data Summery search does not pick up this index automatically as a search hint. Guess: Works as designed? [tcp://8097] shows the hints and [splunktcp://8097] not? Thanks for your Help!! ... View more

But I cannot see any messages in the search menu or on the port 8097. Where does it go? ... View more

This is the service on the forwarder: root@ebs-v-xxxx:local[400] # netstat -an |grep 8089 tcp 0 0 0.0.0.0:8089 0.0.0.0:* LISTEN I can't connect from the indexer to this port (firewall). Is it needed? I assume that the forwarder needs to connect to the indexer only and not vice versa. In the settings menu -> indexes: I can see a slow event count increase for the airlock index. ... View more

And created an index: (location: /opt/splunk/etc/system/default/indexes.conf) ... [airlock] homePath = $SPLUNK_DB/airlockdb/db coldPath = $SPLUNK_DB/airlockdb/colddb thawedPath = $SPLUNK_DB/airlockdb/thaweddb tstatsHomePath = volume:_splunk_summaries/airlockdb/datamodel_summary disabled = false ... ... View more

Is this what you mean? Then i did. root@ebs-v-xxxx:local[381] # pwd /opt/splunkforwarder/etc/system/local root@ebs-v-xxxx:local[382] # cat inputs.conf [default] host = ebs-v-xxxx [monitor:///data/log/airlock/Web-Requests/*.Access] index = airlock sourcetype = airlock:web:access [monitor:///data/log/airlock/Web-Requests/*.Authentication] index = airlock sourcetype = airlock:web:authentication [monitor:///data/log/airlock/Web-Requests/*.Security] index = airlock sourcetype = airlock:web:security [monitor:///data/log/airlock/Web-Requests/*.Usage] index = airlock sourcetype = airlock:web:usage [monitor:///data/log/airlock/System/*.Configuration] index = airlock sourcetype = airlock:sys:configuration [monitor:///data/log/airlock/System/*.default] index = airlock sourcetype = airlock:sys:default [monitor:///data/log/airlock/System/*.Health] index = airlock sourcetype = airlock:sys:health [monitor:///data/log/airlock/System/*.Network] index = airlock sourcetype = airlock:sys:network [monitor:///data/log/airlock/System/*.Security] index = airlock sourcetype = airlock:sys:security ... View more

metrics.log looks ok? Telnet test from the source: root@ebs-v-airlock03a:~[371] # date; telnet 172.20.1.50 8097 **Tue Jan 6 12:07:18 CET 2015** Trying 172.20.1.50... Connected to 172.20.1.50. Escape character is '^]'. test Connection closed by foreign host. And the metrics.log: 01-06-2015 12:07:18.735 +0100 INFO StatusMgr - destPort=8097, eventType=connect_done, group=tcpin_connections, sourceHost=172.20.1.16, sourceIp=172.20.1.16, sourcePort=36903, statusee=TcpInputProcessor 01-06-2015 12:07:18.735 +0100 INFO StatusMgr - sourcePort=8097, ssl=false, statusee=TcpInputProcessor 01-06-2015 12:07:21.363 +0100 INFO StatusMgr - destPort=8097, eventType=connect_close, group=tcpin_connections, sourceHost=172.20.1.16, sourceIp=172.20.1.16, sourcePort=36903, statusee=TcpInputProcessor ... View more

Looks ok to me? splunk@xxxx:~/var/log/splunk$ grep 8097 splunkd.log 01-06-2015 09:54:18.694 +0100 INFO TcpInputProc - Stopping IPv4 port 8097 01-06-2015 09:54:51.950 +0100 INFO TcpInputConfig - IPv4 port 8097 is reserved for splunk 2 splunk 01-06-2015 09:54:51.950 +0100 INFO TcpInputConfig - IPv4 port 8097 will negotiate new-s2s protocol 01-06-2015 10:11:25.311 +0100 INFO TcpInputProc - Stopping IPv4 port 8097 01-06-2015 10:11:49.546 +0100 INFO TcpInputConfig - IPv4 port 8097 is reserved for splunk 2 splunk 01-06-2015 10:11:49.546 +0100 INFO TcpInputConfig - IPv4 port 8097 will negotiate new-s2s protocol ... View more