https://community.splunk.com/t5/Getting-Data-In/Indexing-logs-to-remote-server/m-p/104420#M21993 <P>This is a general guideline of where the different conf files should live. If you need more details I suggest you re-read the documentation with this guideline in mind. Good luck.</P> <P>inputs.conf needs to be defined on both the forwarders and the indexers.</P> <UL> <LI>On the forwarders it needs to define what you are monitoring and what index to write to</LI> <LI>On the indexer it needs to define the port and such that it needs to listen at</LI> </UL> <P>outputs.conf needs to be defined on the forwarders</P> <UL> <LI>It needs to define what indexer it will write to</LI> </UL> <P>props.conf needs to be defined on the indexer</P> <UL> <LI>It needs to define how to parse the data by sourcetype that it receives</LI> </UL> <P>indexes.conf needs to be defined on the indexer</P> <UL> <LI>It needs to define the basic information for where the data should be stored</LI> </UL> Tue, 23 Apr 2013 18:52:53 GMT aholzer 2013-04-23T18:52:53Z https://community.splunk.com/t5/Getting-Data-In/Indexing-logs-to-remote-server/m-p/104419#M21992 <P>I have installed 1 forwarder on my linux machine-1 and another on windows apache machine-2. The splunk has been installed on another windows machine-3. i was able to enable the receiving and am able to view forwader in splunk.<BR /> Now i need to monitor my apache logs from machine-1 and application logs from machine-2 from the remote machine-3 where splunk is installed. I have read the documentations, but it didnt helped me much.<BR /> What entry need to be made in outputs.conf on forwader and inputs.conf on splunk for this requirement.</P> Tue, 23 Apr 2013 17:50:34 GMT https://community.splunk.com/t5/Getting-Data-In/Indexing-logs-to-remote-server/m-p/104419#M21992 eippops 2013-04-23T17:50:34Z https://community.splunk.com/t5/Getting-Data-In/Indexing-logs-to-remote-server/m-p/104420#M21993 <P>This is a general guideline of where the different conf files should live. If you need more details I suggest you re-read the documentation with this guideline in mind. Good luck.</P> <P>inputs.conf needs to be defined on both the forwarders and the indexers.</P> <UL> <LI>On the forwarders it needs to define what you are monitoring and what index to write to</LI> <LI>On the indexer it needs to define the port and such that it needs to listen at</LI> </UL> <P>outputs.conf needs to be defined on the forwarders</P> <UL> <LI>It needs to define what indexer it will write to</LI> </UL> <P>props.conf needs to be defined on the indexer</P> <UL> <LI>It needs to define how to parse the data by sourcetype that it receives</LI> </UL> <P>indexes.conf needs to be defined on the indexer</P> <UL> <LI>It needs to define the basic information for where the data should be stored</LI> </UL> Tue, 23 Apr 2013 18:52:53 GMT https://community.splunk.com/t5/Getting-Data-In/Indexing-logs-to-remote-server/m-p/104420#M21993 aholzer 2013-04-23T18:52:53Z