topic Splunk Forwarder in Getting Data In

Splunk Forwarder

gaurav_a — Wed, 23 Nov 2011 13:16:51 GMT

I am new to splunk, want to forward my logs by universal forwarder to specific index by CLI. Please help me out.

Re: Splunk Forwarder

sdwilkerson — Wed, 23 Nov 2011 14:06:26 GMT

Gaurav_a,
There are a few ways to do this. The most straight-forward way is to add the "index=foo" line to your stanzas in inputs.conf as described in the docs. For example, if this were for a UF on Windows to collect normal WinEventLogs, and you want to forward events to an index called "windows", you could add the index line to your inputs.conf to make it look like this:

[WinEventLog:Security]
index=windows

You can also achieve the same results via the Splunk CLI commands.

There are also more advanced techniques if they suite your use-case more appropriately.

Best,
Sean

Re: Splunk Forwarder

MHibbin — Wed, 23 Nov 2011 14:09:22 GMT

Hi there is a guide in the Splunk Documentation:

http://docs.splunk.com/Documentation/Splunk/latest/Deploy/Setupforwardingandreceiving

However a simple overview, would be to configure your input stanzas (on the Universal forwarder) in $SPLUNK_HOME/etc/apps/search/localinputs.conf file, e.g.

[monitor:///opt/log/vmail]
sourcetype = iis-2
host_regex = iis_(.*)\.log

Then on the indexer (receiver) configure $SPLUNK_HOME/etc/system/local/inputs.conf to listen on the forwarders unique port which you choose (e.g. 8011 in this example)...

[default]
host = ubuntu

[splunktcp://8011]
index=universaForwarder      #(for example)

Then back on the forwarder, configure your $SPLUNK_HOME/etc/system/local/outputs.conf file with the address/port numbers you want to forward to, e.g. (here I forward to another Splunk instance on my same machine, so only need to change port number)....

[tcpout]
defaultGroup = 127.0.0.1_8011
disabled = false

[tcpout:127.0.0.1_8011]
server = 127.0.0.1:8011