topic Re: what is the difference in configuration between forwarders for receiving and sending in Getting Data In

what is the difference in configuration between forwarders for receiving and sending

windyita — Wed, 12 Feb 2014 08:19:27 GMT

I have read another Q&A
http://answers.splunk.com/answers/50082/how-do-i-configure-a-splunk-forwarder-on-linux
but I'm confused whether the steps should be done on the receiver or the sender.
thanks in advance

MuS — Wed, 12 Feb 2014 08:33:16 GMT

Hi windyita,

universal forwarder is the sender and indexer is the receiver, so

Steps 1-3 are obviously done on the universal forwarder
Step 4 is done on the indexer which is the receiver, if it has not been done before. This is a one time action.
Steps 5-7 are done on the universal forwarder

hope this helps ...

cheers, MuS

windyita — Wed, 12 Feb 2014 08:41:13 GMT

I actually did as what you have said, but in step 7:
Step 7: Add Data:

/opt/splunkforwarder/bin/splunk add monitor /path/to/app/logs/ -index main -sourcetype %app%

This will create a file: inputs.conf in /opt/splunk/etc/apps/search/local/

Note: System logs in /var/log/ are covered in the configuration part of Step 7. If you have application logs in /var/log/*/

I didn't find inputs.conf in /opt/splunk/etc/apps/search/local/

What is the reason ? thx