Hello, I am having issues getting data into Splunk Cloud with two new Universal forwarders. I have two existing Universal Forwarders that are working just fine, but I am migrating these to new servers. Same Universal Forwarder version on both the old and new servers (9.4.3) I have the Universal Forwader software installed on both the new Linux servers. I copied the inputs.conf and outputs.conf files from the old servers. I also installed splunkclouduf.spl that I downloaded from my Splunk Cloud instance. The usage for these forwarders is limited to syslog messages only. I receive syslog messages from other devices on port 514 of the Universal Forwarders (UDP and TCP allowed) and those messages forward to Splunk Cloud. Pretty simple setup. I have confirmed that traffic is being received on the servers on port 514 using tcpdump. However, none of that traffic is reaching Splunk Cloud. I can see the new forwarders in the Splunk Cloud Monitoring Console under Forwarders->Versions and Forwarders->Instance. But no data is being received from the new forwarders. Below are my inputs.conf and outputs.conf files from one of the new servers. As you can see, very simple setup and outputs.conf is doing nothing. Again, these were copied from my old working servers exactly, except for the hostname on the new forwarders. ---------------------------------------- inputs.conf [default]
host = NHC-NETSplunkForwarder
[tcp://514]
acceptFrom = *
connection_host=ip
index=nhcnetwork
sourcetype=NETWORK
disabled=0
[udp://514]
acceptFrom = *
connection_host=ip
index=nhcnetwork
sourcetype=NETWORK ---------------------------------------- outputs.conf (sanitized) #This breaks stuff. The credentials package provides what is needed here. Leave commented out.
#[tcpout]
#defaultGroup = splunkcloud,default-autolb-group
#[tcpout:default-autolb-group]
#server = XXXXXXX.splunkcloud.com:9997
#disabled = false
#[tcpout-server://XXXXXXX.splunkcloud.com:9997] Do I need to do something in Splunk Cloud to allow these new forwarders to send data? I don't know how splunkclouduf.spl works so I don't know a way to monitor output traffic from the Universal Forwarder. Any suggestions or tips are appreciated. Thanks, -Pete
... View more
