https://community.splunk.com/t5/Getting-Data-In/Unviersal-Forwarder-without-an-app/m-p/20791#M3054 <P>You'd need to set up a monitor stanza inside of your inputs.conf on the Universal forwarder where the files that you'd like to monitor exist. You would specify the index in inputs.conf on your universal forwarder. This will route the data into the index, presuming it exists, on the Indexer/Receiver you've configured. </P> Wed, 01 Jun 2011 15:50:52 GMT jbsplunk 2011-06-01T15:50:52Z https://community.splunk.com/t5/Getting-Data-In/Unviersal-Forwarder-without-an-app/m-p/20790#M3053 <P>Basically I want to be able to send JBoss server logs from one linux machine to another using the Splunk Universal Forwarder.</P> <P>What do i need to configure?</P> <OL> <LI>I installed the splunk universal forwarder on the linux machine with JBoss.</LI> <LI>I set up the receiving machine to listen on port 9997.</LI> </OL> <P>I also want the logs to go to a particular index.</P> <P>Do I set up the monitor? Which side do monitors get set up? Which side does inputs.conf need updated? </P> Wed, 01 Jun 2011 15:43:44 GMT https://community.splunk.com/t5/Getting-Data-In/Unviersal-Forwarder-without-an-app/m-p/20790#M3053 htkhtk 2011-06-01T15:43:44Z https://community.splunk.com/t5/Getting-Data-In/Unviersal-Forwarder-without-an-app/m-p/20791#M3054 <P>You'd need to set up a monitor stanza inside of your inputs.conf on the Universal forwarder where the files that you'd like to monitor exist. You would specify the index in inputs.conf on your universal forwarder. This will route the data into the index, presuming it exists, on the Indexer/Receiver you've configured. </P> Wed, 01 Jun 2011 15:50:52 GMT https://community.splunk.com/t5/Getting-Data-In/Unviersal-Forwarder-without-an-app/m-p/20791#M3054 jbsplunk 2011-06-01T15:50:52Z