topic Re: How do I find out the settings for a universal forwarder in Getting Data In

How do I find out the settings for a universal forwarder

teagerton — Mon, 04 Jun 2012 12:57:23 GMT

I've been given ownership of Splunk at my job. I've gone through most of the manuals, but I haven't seen anything that answers this question. The universal forwarder is on a Windows 2003 server and splunk is on it's own Red Hat server. Currently Splunk is working for all jobs that have been created, but I can't get the forwarder on windows to work.

Re: How do I find out the settings for a universal forwarder

jeff — Mon, 04 Jun 2012 13:23:46 GMT

More detail would be helpful to the community to give you better direction. Generically, you can figure out your applied settings by running the command:

splunk cmd btool [conf file] list --debug

... so to figure that you have the forwarder correctly configured to send data to your indexer, you would run

splunk cmd btool outputs list --debug

You can also dig through the logs at

$SPLUNK_HOME/var/log/splunk

Re: How do I find out the settings for a universal forwarder

mikelanghorst — Fri, 08 Jun 2012 04:09:40 GMT

pointing out that "cmd btool" is especially helpful in that it will show you the resulting configuration when you may have multiple apps' configuration files.