Greetings, I am having issues with my heavy forwarder getting data into my indexers without having a local indexes.conf containing the index name. I am doing all .conf work from the cli and not the webUI.   The issue is the "forwardedindex.filter.disbale=true" is not working as expected and I have to either: 1.  Create a local copy of the index I want to send to in indexes.conf 2. Add the index name to the whitelist setting for outputs.conf Otherwise data does not get sent to the indexers. Assistance please. Here is my output.conf for example: [tcpout] defaultGroup = test_indexers forwardedindex.filter.disable = true indexAndForward = false [tcpout:test_indexers] #server = <ip address>:<9996> server = x.x.x.x:9996,x.x.x.x:9996 disabled = false sslPassword = <nope> sslCertPath = $SPLUNK_HOME sslRootCAPath = $SPLUNK_HOME ... View more

Greetings, I am having issues connecting to my LM.  The systems are in two different networks and I have confirmed via nmap and curl that I am able to connect to the remote LM box from the LS box.  I have also confirmed via netstat that the LS box is listening on  :8089 I am receiving this error when attempting to connected to the LM via splunk web: Splunkd daemon is not responding: ('Error connecting to /services/licenser/localslave/license: The read operation timed out',) Yes the LM system is online.  Yes the License is Enterprise. The only think I see in splunkd.log on the LM is the following: WARN HttpListener - Socket error from LS.ip:46822 while idling: Read Timeout I have checked the pass4SymKey as well and they match between the LM and LS. Is it possible that the ciphers are not the same between the two and the LM is not properly decrypting the password for auth?  Or would I see ssl/auth errors in the logs?   Thanks   ... View more