topic Re: Universal forwarder - configuration in Splunk Enterprise

Universal forwarder - configuration

verifi81 — Mon, 23 Nov 2020 00:33:09 GMT

Hello,

On a Universal Forwarder can someone tell me where the config is that tells the universal forwarder where to send the logs?

I need this for Windows and Linux.

Thank you

Re: Universal forwarder - configuration

vikramyadav — Mon, 23 Nov 2020 04:33:30 GMT

Hi @verifi81

You can check out this video

https://www.splunk.com/en_us/resources/videos/splunk-education-getting-data-in-with-forwarders.html

And blog too

https://geek-university.com/splunk/configure-a-splunk-forwarder-on-linux/

-------------------------------------

If this help your like will be appreciated 🙂

Re: Universal forwarder - configuration

verifi81 — Mon, 23 Nov 2020 05:19:23 GMT

appreciate the quick response, but that video and blog did not tell me which file to view those settings at. My universal forwarders are already forwarding to an index and I'm simply trying to find which file I can CAT to view the indexer.

Re: Universal forwarder - configuration

verifi81 — Mon, 23 Nov 2020 05:29:17 GMT

I found it.

It's under $SPLUNK_HOME/etc/apps/search/local/

The file is outputs.conf

Re: Universal forwarder - configuration

vikramyadav — Mon, 23 Nov 2020 05:40:52 GMT

I'm not sure which log file you are interested in so you can use btool to check outputs.conf

For Linux and Linux

$Splunk_Home/splunk btool outputs list --debug

-------------------------------------

If this help your like will be appreciated 🙂