topic Re: Splunk Universal Forwarder in Deployment Architecture

Splunk Universal Forwarder

heykumaran — Thu, 11 Jul 2013 20:02:01 GMT

Hello,

I installed my Splunk Universal Forwarder in CentOS Server. and started the client on the server..

i get this message

Checking prerequisites...
Checking mgmt port [8089]: open
Checking conf files for typos... Done
All preliminary checks passed.

Starting splunk server daemon (splunkd)... Done

Then how i setup in the Splunk Server to receive logs?

Help me?

Re: Splunk Universal Forwarder

Ayn — Thu, 11 Jul 2013 20:16:35 GMT

This is essentially you asking "how does Splunk work"? http://docs.splunk.com/Documentation/Splunk/latest/Data/WhatSplunkcanmonitor

Re: Splunk Universal Forwarder

sdaniels — Thu, 11 Jul 2013 20:17:33 GMT

Here is the link in the docs for setting up receiving on the Splunk server.

http://docs.splunk.com/Documentation/Splunk/5.0.3/Deploy/Enableareceiver

Once you do that you'll want to read this for configuring inputs.conf on the forwarder to begin bringing data into splunk.

http://docs.splunk.com/Documentation/Splunk/5.0.3/Data/Usingforwardingagents

Re: Splunk Universal Forwarder

heykumaran — Thu, 11 Jul 2013 20:24:17 GMT

Thanks
i did (Set up receiving with Splunk Web) and restarted the Splunk server... but i didn't see the client (CentOS) data on the website?

Helop me?

Re: Splunk Universal Forwarder

sdaniels — Thu, 11 Jul 2013 20:27:36 GMT

You aren't going to see it with that admin interface of Splunk. Once you configure something to be monitored and the data gets to the Splunk server you'll start seeing data in the Search app within splunk from that host.

Take a few minutes to read the docs and it'll be very easy.

http://docs.splunk.com/Documentation/Splunk/5.0.3/Data/Editinputs.conf