About Ziadm

Ziadm · ‎10-05-2022

I cant believe it , the solution in this thread worked for me https://community.splunk.com/t5/Monitoring-Splunk/Tcpout-Processor-The-TCP-output-processor-has-paused-the-data/m-p/304653 i don't even know how this outputs file got there but alright

Ziadm · ‎10-05-2022

you are more than welcome to remote into my lab and check things out yourself if you want to

Ziadm · ‎10-05-2022

Ok my bad so i ran the search and no the UF isn't sending anything, i also ran all the searches here and they all returned 0 events https://docs.splunk.com/Documentation/Splunk/7.2.4/Troubleshooting/Cantfinddata?_gl=1*ip55yp*_ga*NjE3MDIzNDc2LjE2NjQ3MzMzNTE.*_gid*MTQxNzM3NDg5MS4xNjY0NzMzMzUx&_ga=2.12130356.1417374891.1664733351-617023476.1664733351 the last one though that i ran in the cli returned an ssl error that i think is irrelevant to my issue

Ziadm · ‎10-05-2022

So as i said already I'm not getting any logs from the DC and I'm using the Splunk add on for windows to get the logs and yes i was able to telnet into using the 9997 port without an issue even though i didn't really need to because i had confirmed before with netstat that there was an established connection on this port between my dc and the Splunk instance and as per the this screen shot i believe it confirms that there's a connection between the two machines in fact the deployment server is working fine so i don't really know where the issue is to be honest , i had disabled the firewall on both machines but that didn't help at all

Ziadm · ‎10-04-2022

another pic from the gui

Ziadm · ‎10-04-2022

@gcusello thank you for the help , here's the link for the other question https://community.splunk.com/t5/Installation/UF-isn-t-sending-data-to-indexer/m-p/615867#M11981

Ziadm · ‎10-04-2022

I just set up the UF on my DC (it's a lab environment) and I can confirm that both are connected on the specified ports using netstat but I'm not getting any logs from my DC. I'm also using Splunk add-on for windows and enabled logs for sysmon and AD only. This is my inputs file for the add on. And I keep getting these errors in my Splunk instance here's also the log file for splunkd

Ziadm · ‎10-03-2022

I checked with netstat and the connection has been established but i got a couple of weird errors in splunk that i don't know what they mean and I'm still unable to get the events from the DC

Ziadm · ‎10-03-2022

i was able to solve the issue on my own apparently the firewall on the domain was blocking the connection to the deployment server/indexer so i got this out of the way but now I'm facing another issue after setting up everything I'm not receiving any events from the dc , i used the sysmon app because I only want to get the sysmon events for now and I've enabled the inputs file as shown in the pic here e

Ziadm · ‎10-02-2022

it's important to note that i'm using the free trial so i can't open a ticket with support i'm just trying to practice Splunk on my own

Ziadm · ‎10-02-2022

The log File

Ziadm · ‎10-02-2022

So today i installed the forwarder on a DC that is hosted on a VM but i cant seem to get any logs from this machine i've already enabled Splunk to listen on 9997 for receiving I'm also using the Splunk for windows addon and enabled all the logs from the config file (after copying it to the local directory) and the Splunk instance is hosted on the host machine and I've already setup the networking between the host and the VM i basically followed this Guide but i still can't get to forward the events , am i missing any steps here? , i also confirmed that the indexer was set correctly from the outputs file i was able to input data from the local host without an issue before if that helps

Ziadm · ‎10-02-2022

for some weird reason now when i try to install it again it triggers the blue screen even after trying a fresh windows installation it's a VM if that matters at all

Ziadm · ‎10-02-2022

i was trying to install it on the dc but the wizard fails and says something along the line that it ended prematurely , but now i'm running into a blue screen issue on my DC so i'll come back to that later

Ziadm · ‎10-01-2022

and before anyone asks i setup dhcp reservation for both the dc and the machine hosting the splunk instance

Ziadm · ‎10-01-2022

so i was trying to install a forwarder on the DC and i ran into this issue here is the link to the log file since i cant figure out how to attach it here https://drive.google.com/file/d/1j73adahjOwc52lE6Oxxi6lBzAFHpErK1/view?usp=sharing

Posts	16
Solutions	1
Karma Given	4
Karma Received	0
Member Since	‎10-01-2022

Online Status	Offline
Date Last Visited	‎10-05-2022 02:52 AM

Why isn't my UF sending data to indexer?

Splunk Forwarder on DC 2022 unable to receive data...

Why did my Splunk Forwarder end prematurely?

Re: UF isn't sending data to indexer?

Re: UF isn't sending data to indexer?

Re: UF isn't sending data to indexer?

Re: UF isn't sending data to indexer?

Re: UF isn't sending data to indexer?

Re: Splunk Forwarder ended prematurely

Why isn't my UF sending data to indexer?

Re: Splunk Forwarder ended prematurely

Re: Splunk Forwarder ended prematurely

Re: Splunk Forwarder on DC 2022 unable to receive ...

Re: Splunk Forwarder on DC 2022 unable to receive ...

Splunk Forwarder on DC 2022 unable to receive data...

Re: Splunk Forwarder ended prematurely

Re: Splunk Forwarder ended prematurely

Re: Splunk Forwarder ended prematurely

Why did my Splunk Forwarder end prematurely?