Hello all!
I have banged my head for about 2 hours trying to figure out why my universal forwarder won't transfer data to my Heavy Forwarder.
Steps I have done:
- Opened receiving **port 80** on Heavy Forwarder
- The heavy forwarder's forwarding port has been configured correctly (HTTP data inputs forward correctly)
- netstat -lpnt -> shows that 0.0.0.0:80 is in **LISTEN** mode
- Using **tcping.exe** from my Windows client, I was able to successfully **/tcping.exe server-ip port**
- **Ping** server-ip is successful
- I added a forwarder server **./splunk add forward-server server-ip:port** with correct port
- I added the server to **NO_PROXY** env var
outputs.conf:
[tcpout]
defaultGroup = default-autolb-group
[tcpout:default-autolb-group]
server = ip:port
[tcpout-server://ip:port]
inputs.conf
[default]
host = hostname
Universal Forwarder log:
09-20-2018 09:15:52.949 -0400 WARN TcpOutputProc - Tcpout Processor: The TCP output processor has paused the data flow. Forwarding to output group default-autolb-group has been blocked for 249499 seconds. This will probably stall the data flow towards indexing and other network outputs. Review the receiving system's health in the Splunk Monitoring Console. It is probably not accepting data.
09-20-2018 09:15:57.504 -0400 INFO DC:DeploymentClient - channel=tenantService/handshake Will retry sending handshake message to DS; err=not_connected
09-20-2018 09:15:57.504 -0400 INFO DC:PhonehomeThread - Attempted handshake 2430 times. Will try to re-subscribe to handshake reply
09-20-2018 09:16:00.296 -0400 WARN HttpPubSubConnection - Unable to parse message from PubSubSvr:
09-20-2018 09:16:00.296 -0400 INFO HttpPubSubConnection - Could not obtain connection, will retry after=72.778 seconds.
09-20-2018 09:16:09.515 -0400 INFO DC:DeploymentClient - channel=tenantService/handshake Will retry sending handshake message to DS; err=not_connected
I have also restarted both my heavy forwarder and universal forwarder.
When running the **./splunk list forward-server**, my server and IP is listed under "Configured but inactive"
Any thoughts?
↧