https://community.splunk.com/t5/Getting-Data-In/After-installing-the-Universal-Forwarder-using-MSI-I-am-not/m-p/250170#M48115 <P>Try checking your universal forwarder installation against these instructions: <BR /> <A href="http://docs.splunk.com/Documentation/SplunkLight/6.5.0/GettingStarted/GettingdataintoSplunkLightusingWindows">http://docs.splunk.com/Documentation/SplunkLight/6.5.0/GettingStarted/GettingdataintoSplunkLightusingWindows</A></P> Mon, 10 Oct 2016 18:09:14 GMT gneumann_splunk 2016-10-10T18:09:14Z https://community.splunk.com/t5/Getting-Data-In/After-installing-the-Universal-Forwarder-using-MSI-I-am-not/m-p/250169#M48114 <P>I installed the Universal Forwarder using the MSI, specified server info, but didn't check any boxes for wineventlog and such. I can see the PC checking in on the Splunk server, but it's not receiving any data. This is my ...\etc\system\local\inputs.conf</P> <PRE><CODE>[default] host = PBDC-LT-16 [WinEventLog:System] interval=60 index=wineventlog disabled=0 [WinEventLog:Security] interval=60 index=wineventlog disabled=0 [WinEventLog:Application] interval=60 index=wineventlog disabled=0 </CODE></PRE> Mon, 10 Oct 2016 17:48:13 GMT https://community.splunk.com/t5/Getting-Data-In/After-installing-the-Universal-Forwarder-using-MSI-I-am-not/m-p/250169#M48114 tmontney 2016-10-10T17:48:13Z https://community.splunk.com/t5/Getting-Data-In/After-installing-the-Universal-Forwarder-using-MSI-I-am-not/m-p/250170#M48115 <P>Try checking your universal forwarder installation against these instructions: <BR /> <A href="http://docs.splunk.com/Documentation/SplunkLight/6.5.0/GettingStarted/GettingdataintoSplunkLightusingWindows">http://docs.splunk.com/Documentation/SplunkLight/6.5.0/GettingStarted/GettingdataintoSplunkLightusingWindows</A></P> Mon, 10 Oct 2016 18:09:14 GMT https://community.splunk.com/t5/Getting-Data-In/After-installing-the-Universal-Forwarder-using-MSI-I-am-not/m-p/250170#M48115 gneumann_splunk 2016-10-10T18:09:14Z https://community.splunk.com/t5/Getting-Data-In/After-installing-the-Universal-Forwarder-using-MSI-I-am-not/m-p/250171#M48116 <P>Is your <CODE>outputs.conf</CODE> pointing to your indexer? Did you restart the Splunk web service after making these changes?</P> Mon, 10 Oct 2016 18:31:05 GMT https://community.splunk.com/t5/Getting-Data-In/After-installing-the-Universal-Forwarder-using-MSI-I-am-not/m-p/250171#M48116 skoelpin 2016-10-10T18:31:05Z https://community.splunk.com/t5/Getting-Data-In/After-installing-the-Universal-Forwarder-using-MSI-I-am-not/m-p/250172#M48117 <P>Very nice, I didn't realize this was an option. However, it's a bit light. The config files have far more options to configure, and I can't determine how to do that.</P> Mon, 10 Oct 2016 18:41:50 GMT https://community.splunk.com/t5/Getting-Data-In/After-installing-the-Universal-Forwarder-using-MSI-I-am-not/m-p/250172#M48117 tmontney 2016-10-10T18:41:50Z https://community.splunk.com/t5/Getting-Data-In/After-installing-the-Universal-Forwarder-using-MSI-I-am-not/m-p/250173#M48118 <P>Yep, outputs.conf is fine. The inputs.conf file I'm referencing here is on the forwarder, not the server. Why would I restart the server?</P> Mon, 10 Oct 2016 18:47:54 GMT https://community.splunk.com/t5/Getting-Data-In/After-installing-the-Universal-Forwarder-using-MSI-I-am-not/m-p/250173#M48118 tmontney 2016-10-10T18:47:54Z https://community.splunk.com/t5/Getting-Data-In/After-installing-the-Universal-Forwarder-using-MSI-I-am-not/m-p/250174#M48119 <P>Try the Splunk Enterprise Getting Data In manual, which has more information:<BR /> <A href="http://docs.splunk.com/Documentation/Splunk/6.5.0/Data/AboutWindowsdataandSplunk">http://docs.splunk.com/Documentation/Splunk/6.5.0/Data/AboutWindowsdataandSplunk</A></P> Mon, 10 Oct 2016 18:51:09 GMT https://community.splunk.com/t5/Getting-Data-In/After-installing-the-Universal-Forwarder-using-MSI-I-am-not/m-p/250174#M48119 gneumann_splunk 2016-10-10T18:51:09Z https://community.splunk.com/t5/Getting-Data-In/After-installing-the-Universal-Forwarder-using-MSI-I-am-not/m-p/250175#M48120 <P>More specific instructions for event log monitoring and universal forwarder config info using Windows: <BR /> <A href="http://docs.splunk.com/Documentation/Splunk/6.5.0/Data/MonitorWindowseventlogdata">http://docs.splunk.com/Documentation/Splunk/6.5.0/Data/MonitorWindowseventlogdata</A></P> Mon, 10 Oct 2016 18:57:40 GMT https://community.splunk.com/t5/Getting-Data-In/After-installing-the-Universal-Forwarder-using-MSI-I-am-not/m-p/250175#M48120 gneumann_splunk 2016-10-10T18:57:40Z https://community.splunk.com/t5/Getting-Data-In/After-installing-the-Universal-Forwarder-using-MSI-I-am-not/m-p/250176#M48121 <P>Again, I have followed that. I have changed /etc/system/local/inputs.conf to the config shown above, on the local forwarder. I restarted the Splunk Forwarder service, and did not see any change.</P> Mon, 10 Oct 2016 19:09:34 GMT https://community.splunk.com/t5/Getting-Data-In/After-installing-the-Universal-Forwarder-using-MSI-I-am-not/m-p/250176#M48121 tmontney 2016-10-10T19:09:34Z https://community.splunk.com/t5/Getting-Data-In/After-installing-the-Universal-Forwarder-using-MSI-I-am-not/m-p/250177#M48122 <P>Here's a similar situation on Answers that might help resolve your issue: <BR /> <A href="https://answers.splunk.com/answers/98072/not-receiving-data-from-windows-forwarder.html">https://answers.splunk.com/answers/98072/not-receiving-data-from-windows-forwarder.html</A></P> <P>In particular "Have you opened the port on your Splunk indexer to receive data from the forwarder? I would try doing a tcpdump/netstat to see if data is leaving the Windows box and/or being received on the Splunk Indexer."</P> Mon, 10 Oct 2016 20:24:12 GMT https://community.splunk.com/t5/Getting-Data-In/After-installing-the-Universal-Forwarder-using-MSI-I-am-not/m-p/250177#M48122 gneumann_splunk 2016-10-10T20:24:12Z https://community.splunk.com/t5/Getting-Data-In/After-installing-the-Universal-Forwarder-using-MSI-I-am-not/m-p/250178#M48123 <P>If I configure Splunk server to get the data, it works. I'm feeling it's just wrong config rather than ports or firewalls. I'll take a look though.</P> Mon, 10 Oct 2016 21:10:27 GMT https://community.splunk.com/t5/Getting-Data-In/After-installing-the-Universal-Forwarder-using-MSI-I-am-not/m-p/250178#M48123 tmontney 2016-10-10T21:10:27Z https://community.splunk.com/t5/Getting-Data-In/After-installing-the-Universal-Forwarder-using-MSI-I-am-not/m-p/250179#M48124 <P>My apology, it is working actually. I was basing it off the "Last Updated" section of the Search page. It was looking for the hostname rather than the hostname's FQDN (treating them as separate hosts).</P> Mon, 10 Oct 2016 21:20:56 GMT https://community.splunk.com/t5/Getting-Data-In/After-installing-the-Universal-Forwarder-using-MSI-I-am-not/m-p/250179#M48124 tmontney 2016-10-10T21:20:56Z https://community.splunk.com/t5/Getting-Data-In/After-installing-the-Universal-Forwarder-using-MSI-I-am-not/m-p/250180#M48125 <P>Great to know it's working! </P> Mon, 10 Oct 2016 21:46:21 GMT https://community.splunk.com/t5/Getting-Data-In/After-installing-the-Universal-Forwarder-using-MSI-I-am-not/m-p/250180#M48125 gneumann_splunk 2016-10-10T21:46:21Z