Greetings Splunkbase, I'm working on configuring my first universal forwarder - I have a Splunk implementation with multiple syslogs and files being indexed from various sources, but now that I'm looking to forward snort_alert_full logs, I'm heading into unfamiliar territory. What I know: - I'm seeing a heartbeat to the indexing / receiving server, but no data being sent. If I tail /var/log/snort/alert, I see full alerts being generated, but no additional network traffic on tcp port 9997 between the two servers. I do, however, consistently see the heartbeat every few seconds (I think it's a heartbeat? Maybe it's trying to synchronize, connect, etc.?). What I don't know: I created the "receiving" port 9997 on the Splunk indexer - is there anything more I need to do on the indexer? Why, when I add a new user / password (Admin role is assigned) to my Splunk receiver, it isn't allowing me to authenticate remotely: /opt/splunkforwarder/bin/splunk add forward-server 10.0.0.81:9997 -auth forward:test123 Returns: Login failed Login failed Unauthorized In /opt/splunkforwarder/var/log/splunk/splunkd.log I see: 02-08-2012 12:39:55.053 -0700 ERROR UserManagerPro - Login failed for unknown user="forward" I am currently using the "admin:changeme" combo to authenticate for the moment, just for testing purposes. Are my .conf files correct? I spent some time on splunkbase looking for common snort universal forwarder configurations. Here are the contents of my inputs.conf and outputs.conf files: inputs.conf [default] host = server.domain.local [monitor:///var/log/snort/alert] disabled = false index = ids sourcetype = snort_alert _full outputs.conf [tcpout] maxQueueSize = 500KB [tcpout] defaultGroup = splunk [tcpout:splunk] disabled = false server = 10.0.0.81:9997 compressed = false Also, when I start the splunk forwarder, I see this: 02-08-2012 12:49:35.171 -0700 INFO TailingProcessor - Parsing configuration stanza: monitor:///var/log/snort/alert. 02-08-2012 12:49:35.171 -0700 INFO BatchReader - State transitioning from 2 to 0 (initOrResume). 02-08-2012 12:49:35.299 -0700 INFO TcpOutputProc - Connected to idx=10.0.0.81:9997 Thanks for the assistance - please let me know if I can provide any additional information! ... View more