topic Re: How to configure universal forwarders on Windows servers to forward logs to a certain index on a Linux server? in Getting Data In

How to configure universal forwarders on Windows servers to forward logs to a certain index on a Linux server?

ginger8990 — Tue, 30 Dec 2014 17:42:49 GMT

We have a Linux-based Splunk enterprise server (free version)
I installed the universal forwarder on a few windows servers. We created a new index called test_index, but I have some difficulty to forward all logs to the certain index.

Need some advice and help.

Re: How to configure universal forwarders on Windows servers to forward logs to a certain index on a Linux server?

jayannah — Tue, 30 Dec 2014 17:55:08 GMT

Read on how to configure UF to send data to indexer at http://docs.splunk.com/Documentation/Splunk/6.2.1/Forwarding/Setupforwardingandreceiving

You need to create index on indexer and not on UF (uni. forwarder).

Steps.
1. Configure the receiving port on Indexer (inputs.conf for receiving data on port say 9997)
read details at http://docs.splunk.com/Documentation/Splunk/6.2.1/Forwarding/Enableareceiver
2. Configure Uni. Forwarders to send the logs to Indexer (outputs.conf). many examples at end of http://docs.splunk.com/Documentation/Splunk/6.2.1/Admin/Outputsconf
3. Configure the monitoring inputs on Uni. Forwarder (inputs.conf for monitoring the file). Many examples at end of http://docs.splunk.com/Documentation/Splunk/6.2.1/Admin/Inputsconf
Some information on how to get the data into Splunk, please read on
http://docs.splunk.com/Documentation/Splunk/6.2.0/Data/MonitorfilesanddirectoriesusingtheCLI

Re: How to configure universal forwarders on Windows servers to forward logs to a certain index on a Linux server?

ginger8990 — Tue, 30 Dec 2014 18:24:33 GMT

Greatly appreciate your information 🙂

Re: How to configure universal forwarders on Windows servers to forward logs to a certain index on a Linux server?

piebob — Tue, 30 Dec 2014 20:49:20 GMT

ginger, please use the comment field instead of the Answer field when making a comment, and also please 'accept' the answer if it solves your problem. i've done it for you this time. thanks!

Re: How to configure universal forwarders on Windows servers to forward logs to a certain index on a Linux server?

ginger8990 — Tue, 30 Dec 2014 23:45:49 GMT

somehow it didn't work after configured all these settings.
1) I could not see Apps and add client under forwarder management GUI
2) I only want to forward special folder files not event log. Does it forward event logs by default from windows?

Re: How to configure universal forwarders on Windows servers to forward logs to a certain index on a Linux server?

piebob — Tue, 30 Dec 2014 23:50:38 GMT

please stop posting your follow-on comments as new answers.

Re: How to configure universal forwarders on Windows servers to forward logs to a certain index on a Linux server?

ginger8990 — Mon, 05 Jan 2015 19:13:11 GMT

no permission to post comments