So, I got the classic problem of not being able to push data from my forwarder to my receiver.
Things that I've already tried:
- check that the port is available and useable by chatting with myself via nc (nc -l 14000 on my receiver, nc $IP 14000 on my sender)
- reinstalled the receiver because why not
- nearly every fix I could find on this forum that did not involve the firewall, because the port obviously was available
My outputs.conf looks as follows
[tcpout]
defaultGroup = default-autolb-group
[tcpout:default-autolb-group]
server = ##.##.##.##:14000
[tcpout-server://##.###.###.##:14000]
and the inputs.conf on my receiver
[default]
host = host-linux
[splunktcp://14000]
I've tried adding an index-tag to my receivers inputs but to no avail. Also, I'm totally inexperienced with Splunk and wanted to try to make my first steps with my current setup, but obviously did not have any luck yet.
↧