Splunk admin Roadmap- Day- 5 - How to setup a Forwarder?
In this video, we first validate the connection between the Search Head and Indexer using a basic search. We then troubleshoot a common issue where the Search Head is unable to communicate with the Indexer due to authentication or peer connection problems.
In this part, we cover:
Checking Search Head and Indexer connectivity
Understanding errors like “unable to distribute search to peer”
Fixing rejected credentials and peer connection issues
Resolving the problem by removing and re-adding search peers
Confirming successful data flow after reconnection
After fixing the Search Head and Indexer connection, we move on to the main topic of the video — Splunk Universal Forwarder setup.
Universal Forwarder configuration includes:
How Universal Forwarders work and where they are installed
Creating Splunk users and directories on Linux
Installing Splunk Universal Forwarder and required packages
Starting Splunk and accepting the license
Enabling boot-start for Universal Forwarder
Verifying the management port (8089)
Enabling receiving on the Indexer
Configuring outputs.conf to connect the Forwarder to the Indexer
Restarting services and validating log ingestion