topic Re: forwarder Or universal forwarder in Getting Data In

forwarder Or universal forwarder

jimjohn — Tue, 04 Feb 2014 06:43:48 GMT

I have a splunk 6.0.1 installed in my system.
Can i set my mechine as forwarder and receiver.
I need to read vales from DB and forward to same mechine.
Can anybody show tutorials to this.

Also it will be helpful if you can tell me how to set up universal forwarder.

Thanks
Jim John

Re: forwarder Or universal forwarder

MuS — Tue, 04 Feb 2014 10:20:12 GMT

Hi jimjohn,

If you just want to query a DB and forward it to your local Splunk Server, then there is no need to install and setup an universal forwarder in this use case.
Follow the docs on how to Setup DB connect in your local Splunk Server UI and you can use the dbquery search command to get results from the DB directly into your local Splunk Server.

Usually an universal forwarder is installed on remote servers to get data into Splunk.

Hope this helps ...

cheers, MuS

Re: forwarder Or universal forwarder

jimjohn — Tue, 04 Feb 2014 11:01:13 GMT

OK,
I did DB connect in local.
Can you please provide tutorials for configuring universal forwarder.
For testing purpose is it possible to use splunk and universal forwarder in same machine.

Re: forwarder Or universal forwarder

Ayn — Tue, 04 Feb 2014 11:31:46 GMT

http://docs.splunk.com/Documentation/Splunk/6.0.1/Forwarding/Introducingtheuniversalforwarder

Re: forwarder Or universal forwarder

MuS — Tue, 04 Feb 2014 11:34:18 GMT

sure you can do this, here is some intro about the universal forwarder http://docs.splunk.com/Documentation/Splunk/6.0.1/Forwarding/Introducingtheuniversalforwarder also read http://docs.splunk.com/Documentation/Splunk/6.0.1/Forwarding/Aboutforwardingandreceivingdata and last but not least don't forget to enable receiving on the indexer http://docs.splunk.com/Documentation/Splunk/6.0.1/Forwarding/Enableareceiver

hope this helps...

Re: forwarder Or universal forwarder

jimjohn — Tue, 04 Feb 2014 13:03:11 GMT

Last question .
I want to configure DB fetching operation in universal forwarder.
Is it possible? If so please have any tutorials or links

Re: forwarder Or universal forwarder

MuS — Tue, 04 Feb 2014 13:40:23 GMT

according to the docs DB connect should be setup on the search head (the web interface where you do the searches) http://docs.splunk.com/Documentation/DBX/latest/DeployDBX/Otherdeploymentconsiderations . nothing mentioned about setup on universal forwarder though......