topic Re: Basic steps to configure universal forwarder (4.2) in Getting Data In

Basic steps to configure universal forwarder (4.2)

yuriy_zubarev — Sat, 02 Apr 2011 07:52:55 GMT

No migrations, no upgrade, installing forwarders from the ground up.

from splunkd.log

**ERROR TcpOutputProc - LightWeightForwarder/UniversalForwarder not configured. Please configure outputs.conf**

etc/system/local/outputs.conf

[tcpout]
defaultGroup = splunk
server = log1:9997
compressed=true

etc/system/local/deploymentclient.conf

[target-broker:deploymentServer]
targetUri = log1:9997

etc/system/local/inputs.conf

[monitor:///[my folder path]/splunk-test]
disabled = false
followTail = 0
index = default

Splunk on log1 works fine.

Re: Basic steps to configure universal forwarder (4.2)

yuriy_zubarev — Tue, 05 Apr 2011 02:51:27 GMT

Anybody? All I want to have universal forwarder forward log files to a central installation of Splunk on a different host. I noticed some other "forwarder" questions are not answered here. Nobody knows how they work?

Re: Basic steps to configure universal forwarder (4.2)

mslvrstn — Tue, 05 Apr 2011 09:42:24 GMT

I think the issue is that you don't have a stanza corresponding to your defaultGroup. According to the docs, in that case you are disabling automatic forwarding.

I would make your output.conf look more like:

[tcpout]
defaultGroup = splunk

[tcpout:splunk]
disabled = false
server = log1:9997
compressed = true