cli question

asma — Mon, 11 Jun 2012 15:31:20 GMT

How can I change the ip address of the splunk server into an universal forwarder?

Re: cli question

sdaniels — Mon, 11 Jun 2012 15:52:41 GMT

http://docs.splunk.com/Documentation/Splunk/latest/Deploy/Deployanixdfmanually

Configure the universal forwarder to forward to a specific receiving indexer, also known as the "receiver" (optional):

splunk add forward-server : -auth :

where:

<host> is the receiving indexer's hostname or IP address and <port> is the port it's listening on. By convention, the receiver listens for forwarders on port 9997, but it can be set to listen on any port, so you'll need to check with the receiver's administrator to obtain the port number. For information on setting up a receiver, see "Enable a receiver". 

<username>:<password> is the username and password for logging into the forwarder. By default, these are "admin:changeme" (To set a different password than the default , issue the following command "splunk edit user admin -password <new password> -role admin -auth admin:changeme").

topic cli question in Getting Data In

cli question

Re: cli question