https://community.splunk.com/t5/Getting-Data-In/How-to-get-the-data-from-remote-server-through-universal/m-p/214253#M42126 <P>First of all, it must be <CODE>inputs.conf</CODE> and <CODE>outputs.conf</CODE>, not <CODE>input.config</CODE> and <CODE>output.config</CODE> (notice the <CODE>s</CODE> character, in particular, as well as the suffix). Secondly, have you considered this?</P> <P><A href="http://blogs.splunk.com/2014/11/04/splunk-6-2-feature-overview-xml-event-logs/">http://blogs.splunk.com/2014/11/04/splunk-6-2-feature-overview-xml-event-logs/</A></P> Fri, 04 Sep 2015 15:28:33 GMT woodcock 2015-09-04T15:28:33Z https://community.splunk.com/t5/Getting-Data-In/How-to-get-the-data-from-remote-server-through-universal/m-p/214252#M42125 <P>Hi All,</P> <P>We dont have splunk enterprise installed on windows 2008 R2 server. We have installed the Splunk Universal forwarder(6.2.3 version) on windows 2008 R2 server(64-bit). After installing, we configured input.config file and output.config file as,<BR /> input.config:</P> <PRE><CODE>[default] host = WIN-NR8HN3JRK2V [script://$SPLUNK_HOME\bin\scripts\splunk-wmi.path] [splunktcp://8000] disabled = 0 </CODE></PRE> <P>output.config file:</P> <PRE><CODE>[tcpout] defaultGroup = default-autolb-group [tcpout:default-autolb-group] server = 192.168.0.175:8000 [tcpout-server://192.168.0.175:8000] </CODE></PRE> <P>Now, how can I get the log data from windows 2008 R2 server to my splunk server(192.168.0.175:8000) ? where it will be stored in my server?<BR /> Can anyone help me to get out of this?</P> <P>Thanks in advance,<BR /> Mahesh P.</P> Fri, 04 Sep 2015 12:01:30 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-get-the-data-from-remote-server-through-universal/m-p/214252#M42125 Maheshparsi 2015-09-04T12:01:30Z https://community.splunk.com/t5/Getting-Data-In/How-to-get-the-data-from-remote-server-through-universal/m-p/214253#M42126 <P>First of all, it must be <CODE>inputs.conf</CODE> and <CODE>outputs.conf</CODE>, not <CODE>input.config</CODE> and <CODE>output.config</CODE> (notice the <CODE>s</CODE> character, in particular, as well as the suffix). Secondly, have you considered this?</P> <P><A href="http://blogs.splunk.com/2014/11/04/splunk-6-2-feature-overview-xml-event-logs/">http://blogs.splunk.com/2014/11/04/splunk-6-2-feature-overview-xml-event-logs/</A></P> Fri, 04 Sep 2015 15:28:33 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-get-the-data-from-remote-server-through-universal/m-p/214253#M42126 woodcock 2015-09-04T15:28:33Z