https://community.splunk.com/t5/Getting-Data-In/How-to-configure-a-Splunk-universal-forwarder-and-receiver-on/m-p/261895#M50284 <P>Can you please help me in detail with configuring the Splunk universal forwarder and receiver on Windows? I would like to get the data from a forwarder to another Windows system (receiver).</P> Tue, 02 Feb 2016 04:01:44 GMT Umesh_Vedicsoft 2016-02-02T04:01:44Z https://community.splunk.com/t5/Getting-Data-In/How-to-configure-a-Splunk-universal-forwarder-and-receiver-on/m-p/261895#M50284 <P>Can you please help me in detail with configuring the Splunk universal forwarder and receiver on Windows? I would like to get the data from a forwarder to another Windows system (receiver).</P> Tue, 02 Feb 2016 04:01:44 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-configure-a-Splunk-universal-forwarder-and-receiver-on/m-p/261895#M50284 Umesh_Vedicsoft 2016-02-02T04:01:44Z https://community.splunk.com/t5/Getting-Data-In/How-to-configure-a-Splunk-universal-forwarder-and-receiver-on/m-p/261896#M50285 <P>Sure. just follow the below documentation</P> <P><A href="http://docs.splunk.com/Documentation/Splunk/6.3.0/Forwarding/DeployaWindowsdfmanually">http://docs.splunk.com/Documentation/Splunk/6.3.0/Forwarding/DeployaWindowsdfmanually</A><BR /> <A href="http://docs.splunk.com/Documentation/Splunk/6.3.0/Installation/InstallonWindows">http://docs.splunk.com/Documentation/Splunk/6.3.0/Installation/InstallonWindows</A></P> <P>Even there is a video : <A href="http://www.splunk.com/view/SP-CAAAGXB">http://www.splunk.com/view/SP-CAAAGXB</A></P> <P>Once you installed configure your inputs.conf to forward the data</P> <P><A href="http://docs.splunk.com/Documentation/Splunk/6.1/Data/Monitorwindowsdata">http://docs.splunk.com/Documentation/Splunk/6.1/Data/Monitorwindowsdata</A></P> <P><EM>Sample conf</EM></P> <PRE><CODE>[WinEventLog://Security] disabled = 0 start_from = oldest current_only = 0 checkpointInterval = 5 index=&lt;your index&gt; </CODE></PRE> <P>Configure your outputs.conf<BR /> <A href="http://docs.splunk.com/Documentation/Splunk/6.1.3/Forwarding/Configureforwarderswithoutputs.confd">http://docs.splunk.com/Documentation/Splunk/6.1.3/Forwarding/Configureforwarderswithoutputs.confd</A></P> <PRE><CODE>[tcpout:&lt;target_group&gt;] server=&lt;receiving_server1&gt;, &lt;receiving_server2&gt;, ... &lt;attribute1&gt; = &lt;val1&gt; &lt;attribute2&gt; = &lt;val2&gt; </CODE></PRE> <P>Configure your receiver. <A href="http://docs.splunk.com/Documentation/Splunk/6.1/Forwarding/Enableareceiver">http://docs.splunk.com/Documentation/Splunk/6.1/Forwarding/Enableareceiver</A></P> <P><EM>Sample inputs.conf</EM></P> <PRE><CODE>[splunktcp://9997] disabled = 0 </CODE></PRE> Tue, 02 Feb 2016 05:54:37 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-configure-a-Splunk-universal-forwarder-and-receiver-on/m-p/261896#M50285 renjith_nair 2016-02-02T05:54:37Z