About tks_tman

tks_tman · ‎01-14-2023

The logs are being sent from a remote device to-> a linux machine (that contains splunk universal forwarder and syslog-ng) ( and stores logs locally) both of these are to send the logs to -> splunk. Splunk seems to not be accepting the logs from either syslog-ng or the splunk universal forwarder even though the tcp connections are established between both syslog-ng and splunk and splunk universal forwarder and splunk. The requirement is splunk isn't accepting the logs even though the connections are established. I also get the following message with the list forward-server command: tks_tman_0-1673732441766.png

tks_tman · ‎01-14-2023

Yes. I am certain that the local logs are generated. What do you mean by "splunk expects s2s communication on 9997"? Does it require some conversion? How would I go about doing that? image.png

tks_tman · ‎01-14-2023

I have Splunk setup and it establishes connection with syslog and splunk universal forwarder from a remote server: tks_tman_7-1673703578978.png I have syslog-ng setup as follows: tks_tman_9-1673703608134.png tks_tman_11-1673703648538.png You can see the connections established : tks_tman_12-1673703678360.png This is the inputs.conf for the splunk universal forwarder: tks_tman_13-1673703704841.png But still no data is being received by splunk: tks_tman_14-1673703729335.png I was able to use some powershell script to verify that the logs were being sent and delivered to the server with splunk. The issue is with splunk itself. tks_tman_0-1673746273537.png Am I missing something? And how would I go about troubleshooting the issue and fixing it?

Posts	3
Solutions	0
Karma Given	1
Karma Received	0
Member Since	‎01-14-2023

Online Status	Offline
Date Last Visited	‎01-15-2023 04:55 PM

Splunk Not Receiving Logs From Splunk Forwarder or...

Re: Splunk Not Receiving Logs From Splunk Forwarde...

Re: Splunk Not Receiving Logs From Splunk Forwarde...

Splunk Not Receiving Logs From Splunk Forwarder or...

Join the Conversation

Splunk Not Receiving Logs From Splunk Forwarder or...

Re: Splunk Not Receiving Logs From Splunk Forwarde...

Re: Splunk Not Receiving Logs From Splunk Forwarde...

Splunk Not Receiving Logs From Splunk Forwarder or...