Getting Data In

Why are we unable to send collection logs on Universal forwarder to both old and new indexers?

OMohi
Path Finder

Hi

we have a client who wants to migrate sending network devices logs from his universal forwarder server from his POC (search head + indexer) servers to our prod indexers.

But when I point the name of the prod indexers on outputs.conf file under /opt/splunkforwarder/etc/system/local/outputs.conf:

outputs.conf:
[tcpout:indexers] 
server=193.91.168.181:9997,205.145.98.20:9997 

[tcpout] 
defaultGroup=s05 

[tcpout:S05] 
server=LOUWEBWPL20S02:9997,LOUWEBWPL20S03:9997 

autoLB = true 
autoLBFrequency = 31 
forceTimebasedAutoLB = true 
useACK = true

The log collection stops on the orginal POC servers as well as on new indexers there is no data coming.

What am I missing here?

My prod indexer servers are :

LOUXXXWPLXXS02:9997
LOUXXXWPLXXS03:9997

and their POC indexer servers are :

190.XX.XXX.XXX:9997,202.XXX.XXX.XX:9997

Why am I unable to do load balancing?

Thanks,

Mohammed 

0 Karma
1 Solution

jayannah
Builder

Hi

The below change should work for you. I have made 2 corrections.
1. S05 ==> s05 (Upper case 'S' to lower case 'S')
2. defaultGroup=s05 ==> defaultGroup=s05, indexers (This is required to send the same data to both set of indexers)

check and let me know.

               outputs.conf:

                [tcpout] 
                defaultGroup=s05, indexers 

                [tcpout:indexers] 
                server=193.91.168.181:9997,205.145.98.20:9997 

                [tcpout:s05] 
                server=LOUWEBWPL20S02:9997,LOUWEBWPL20S03:9997 
                autoLB = true 
                autoLBFrequency = 31 
                forceTimebasedAutoLB = true 
                useACK = true

=====
Above configuration will work, Incase if the above configuration doesn't work, the check the following
1. User IP address for servers incase if DNS resolution creates problem due to firewall
2. Ensure there are no firewall restrictions
3. Ensure port 9997 opens on indexed (receiver side)

View solution in original post

jayannah
Builder

Hi

The below change should work for you. I have made 2 corrections.
1. S05 ==> s05 (Upper case 'S' to lower case 'S')
2. defaultGroup=s05 ==> defaultGroup=s05, indexers (This is required to send the same data to both set of indexers)

check and let me know.

               outputs.conf:

                [tcpout] 
                defaultGroup=s05, indexers 

                [tcpout:indexers] 
                server=193.91.168.181:9997,205.145.98.20:9997 

                [tcpout:s05] 
                server=LOUWEBWPL20S02:9997,LOUWEBWPL20S03:9997 
                autoLB = true 
                autoLBFrequency = 31 
                forceTimebasedAutoLB = true 
                useACK = true

=====
Above configuration will work, Incase if the above configuration doesn't work, the check the following
1. User IP address for servers incase if DNS resolution creates problem due to firewall
2. Ensure there are no firewall restrictions
3. Ensure port 9997 opens on indexed (receiver side)

OMohi
Path Finder

Thanks for your time on investigating this issue. You were right on. I forgot to mention two target group as my default group. Also there was a typo in one of the default group S for s.

This assisted me in troubleshooting the matter.

Thanks Again !!

Get Updates on the Splunk Community!

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...

Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...