https://community.splunk.com/t5/Getting-Data-In/In-what-path-directory-do-you-find-forwarded-data-from-a/m-p/112434#M23550 <P>When we use universal forwarder, do you know where forwarded data is on the Splunk server?<BR /> Could you please tell me which path/directory for forwarded data?</P> Tue, 31 Mar 2015 04:49:29 GMT 05500 2015-03-31T04:49:29Z https://community.splunk.com/t5/Getting-Data-In/In-what-path-directory-do-you-find-forwarded-data-from-a/m-p/112434#M23550 <P>When we use universal forwarder, do you know where forwarded data is on the Splunk server?<BR /> Could you please tell me which path/directory for forwarded data?</P> Tue, 31 Mar 2015 04:49:29 GMT https://community.splunk.com/t5/Getting-Data-In/In-what-path-directory-do-you-find-forwarded-data-from-a/m-p/112434#M23550 05500 2015-03-31T04:49:29Z https://community.splunk.com/t5/Getting-Data-In/In-what-path-directory-do-you-find-forwarded-data-from-a/m-p/112435#M23551 <P>When you use universal forwarder then it reads data from files, script etc in inputs.conf file <A href="http://docs.splunk.com/Documentation/Splunk/6.2.2/Admin/inputsconf">http://docs.splunk.com/Documentation/Splunk/6.2.2/Admin/inputsconf</A><BR /> and it sends data to indexer given in outputs.conf file<BR /> <A href="http://docs.splunk.com/Documentation/Splunk/6.2.2/Admin/Outputsconf">http://docs.splunk.com/Documentation/Splunk/6.2.2/Admin/Outputsconf</A></P> <P>data in indexer is stored in indexes in location $SPLUNK_HOME/var/lib/splunk in indexer<BR /> <A href="http://docs.splunk.com/Documentation/Splunk/6.2.2/Admin/Splunk-launchconf">http://docs.splunk.com/Documentation/Splunk/6.2.2/Admin/Splunk-launchconf</A></P> Tue, 31 Mar 2015 05:10:48 GMT https://community.splunk.com/t5/Getting-Data-In/In-what-path-directory-do-you-find-forwarded-data-from-a/m-p/112435#M23551 kml_uvce 2015-03-31T05:10:48Z