Getting Data In

I've setup a forwarder on Windows. My receiver is enabled and running tcpdump shows connection. However, Splunk is not indexing data.

bigfatyeastroll
Explorer

one of my team has installed the forwarder on a Windows client. running tcpdump on the backend of splunk enterprise shows:

08:32:06.990056 IP xxx.56097 > splunk.xxx.9997: Flags [P.], seq 777:895, ack 1, win 512, length 118
08:32:06.990080 IP splunk.xxx.9997 >xxx.56097: Flags [.], ack 895, win 2512, length 0

my receiver is enabled on port 9997 but Splunk is not indexing the data. I have other clients using the same setup and they are being indexed.

Thoughts/Suggestions?

0 Karma
1 Solution

bigfatyeastroll
Explorer

The forwarder was not setup using the Domain Admin and using the Domain\Username style. Thank!

View solution in original post

0 Karma

bigfatyeastroll
Explorer

The forwarder was not setup using the Domain Admin and using the Domain\Username style. Thank!

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Verify the forwarder has inputs enabled and that those inputs reference indexes that exist.

---
If this reply helps you, an upvote would be appreciated.
0 Karma

bigfatyeastroll
Explorer

Could it be something in the setup during the installation of the Forwarder?

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!