I'm trying to send log from my Linux installed on Hyper-v windows into my Splunk instance and it data doesn't seem to reach it's destination. I have entered the port number in my Splunk instance - Receive data - configure receiving and entered my port number. i edited my input.conf file and why can't I see my log in Splunk???
write now i am getting error when i try to ping splunkdeploy.customerscallnow.com: name or service not known..i seem to follow a prety nice instruction but i am not yet able to connect
Check the contents of /opt/splunkforwarder/var/log/splunk/splunkd.log on your forwarder (especially the last entries in that log). That should show you whether it tried to connect to the indexer and if it did, why it failed.
it is tryiing to connect but it failes with name or service uknown
So either your outputs.conf in the forwarder point to a wrong server or you have DNS problems in your VM.
index=_internal host=<your UF node name + *> earliest=1
doesn't seem to reply anything.
You could find your UF’s name from its $SPLUNK_HOME/var/log/splunk/splunkd.log. That log file contains also information if it can send it’s own logs to splunk server.
I assume that you have outputs.conf on place and it has defined your splunk server as a target?
iam trying to find my uf node name..im very new to splunk
i don't see my host in the splunk at all.
how can i do that, can you be a bit specific ? thank you
You could make a query on sh like
index=_internal host=<your UF node name + *> earliest=1
this should show some entries, if your UF has connection to server.
Hi
can you see that your UF has sent its internal logs to server?
r. Ismo