LinuxQuestions.org
Visit Jeremy's Blog.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Server
User Name
Password
Linux - Server This forum is for the discussion of Linux Software used in a server related context.

Notices


Reply
  Search this Thread
Old 09-10-2019, 05:37 AM   #1
1s440
Member
 
Registered: Mar 2018
Posts: 136

Rep: Reputation: Disabled
Splunk


Hi all,

I am trying to setup splunk to monitor all the remote hosts on a Splunk server. Without any issues, i have set up the Splunk server. I have installed the Universal forwader on Remote host and provides inputs.conf and outputs.conf as below. But some how these logs are not getting routed to Splunk server. I am stuck here though i change some configuration according to the Splunk documentation, i have not got the output. can anyone suggest me.

Code:
inputs.conf
[default]
[monitor:///var/log/messages]
disabled = 0
source type = messages_log
index = system_log
Code:
outputs.conf
[tcpout:default-autolb-group]
disabled = false
server = 192.189.11.34:9997

Last edited by 1s440; 09-10-2019 at 05:38 AM.
 
Old 09-10-2019, 06:11 AM   #2
dc.901
Member
 
Registered: Aug 2018
Location: Atlanta, GA - USA
Distribution: CentOS 6-7; SuSE 8-12
Posts: 599

Rep: Reputation: 173Reputation: 173
Quote:
Originally Posted by 1s440 View Post
Code:
server = 192.189.11.34:9997
To rule out firewall; from client, if you try to telnet to that splunk server and it's listening port, does it connect?
 
Old 09-10-2019, 06:22 AM   #3
1s440
Member
 
Registered: Mar 2018
Posts: 136

Original Poster
Rep: Reputation: Disabled
Quote:
Originally Posted by dc.901 View Post
To rule out firewall; from client, if you try to telnet to that splunk server and it's listening port, does it connect?
oh yes, Telnet to the port is not listening
Code:
Trying ...
telnet: Unable to connect to remote host: Connection refused
 WARN  TcpOutputProc - The TCP output processor has paused the data flow. Forwarding to output group default-autolb-group has been blocked for 514002 seconds. This will probably stall the data flow towards indexing and other network outputs. Review the receiving system's health in the Splunk Monitoring Console. It is probably not accepting data.
But i have configured the receiving port for splunk dashboard, also I opend the port 9997 on the Remote host. But its unable to connect

Last edited by 1s440; 09-10-2019 at 06:47 AM.
 
Old 09-10-2019, 09:44 AM   #4
dc.901
Member
 
Registered: Aug 2018
Location: Atlanta, GA - USA
Distribution: CentOS 6-7; SuSE 8-12
Posts: 599

Rep: Reputation: 173Reputation: 173
Quote:
Originally Posted by 1s440 View Post
But i have configured the receiving port for splunk dashboard, also I opend the port 9997 on the Remote host. But its unable to connect
Let's simplify, the host running splunk, can you configure to send its logs to splunk?
 
Old 09-11-2019, 04:55 AM   #5
TenTenths
Senior Member
 
Registered: Aug 2011
Location: Dublin
Distribution: Centos 5 / 6 / 7
Posts: 2,930

Rep: Reputation: 1192Reputation: 1192Reputation: 1192Reputation: 1192Reputation: 1192Reputation: 1192Reputation: 1192Reputation: 1192Reputation: 1192
Try this on your Splunk servers, if you don't get the result line then you've not configured Splunk correctly or haven't restarted it.

Code:
# netstat -lnp | grep 9997
tcp        0      0 0.0.0.0:9997            0.0.0.0:*               LISTEN      30215/splunkd
 
Old 09-11-2019, 05:00 AM   #6
TenTenths
Senior Member
 
Registered: Aug 2011
Location: Dublin
Distribution: Centos 5 / 6 / 7
Posts: 2,930

Rep: Reputation: 1192Reputation: 1192Reputation: 1192Reputation: 1192Reputation: 1192Reputation: 1192Reputation: 1192Reputation: 1192Reputation: 1192
Oh, and rather than relying on telnet you can try this to find out if the port is open/listening:

Code:
(echo >/dev/tcp/192.189.11.34/9997) &>/dev/null && echo "open" || echo "closed"
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
Why this site always pop-up a splunk page? suiyi2599 General 1 04-02-2007 10:18 PM
LXer: Search your IT data with Splunk LXer Syndicated Linux News 0 02-20-2007 05:01 PM
Those Splunk ads - what ? bgeddy LQ Suggestions & Feedback 4 02-04-2007 03:31 AM
runner.splunk.com Hitboxx LQ Suggestions & Feedback 3 01-24-2007 07:09 PM
LXer: Splunk Ensures Developers get Their Open Source at Oregon State ... LXer Syndicated Linux News 0 06-26-2006 09:21 PM

LinuxQuestions.org > Forums > Linux Forums > Linux - Server

All times are GMT -5. The time now is 04:33 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration