topic Re: How do I configure a Windows universal forwarder to send data to a receiver? in Getting Data In

How do I configure a Windows universal forwarder to send data to a receiver?

mr_dombat — Wed, 18 Nov 2015 14:04:16 GMT

I have 2 universal forwarders pointing to 1 receiver. All are Windows 64.

I confirm that they are both "seen" by using the dashboard "Forwarders: Deployment" in Splunk Web on the receiver.

I don't know how to get the data into Splunk so it can be indexed. If I choose "data inputs" and choose one of the "forwarder" options, it just says "There are currently no forwarders configured as deployment clients to this instance".

Re: How do I configure a Windows universal forwarder to send data to a receiver?

Sebastian2 — Wed, 18 Nov 2015 14:12:34 GMT

Did you check the Splunk Log-Files (on both, receiver and forwarder)? Is your configuration complete (inputs.conf @ receiver, outputs.conf @ forwarders)?

Re: How do I configure a Windows universal forwarder to send data to a receiver?

chahal3108 — Wed, 18 Nov 2015 14:16:07 GMT

I suggest you to go through this link once:
Setup Universal Forwarder

As suggested in the above link, please make sure that firewall is not blocking that port.