https://community.splunk.com/t5/Getting-Data-In/How-to-send-visual-studio-application-log-to-Splunk-Enterprise/m-p/303463#M57288 <P>I'm assuming Splunk is installed on a separate server that visual studio is installed on?</P> <P>If so then install a Splunk Universal Forwarder on the server with visual studio. Once installed, go back to the server where Splunk is installed and configure it to receive traffic via port 9997 by <CODE>Settings &gt; Forwarding and Receiving &gt; Configure Receiving &gt; New &gt; Add 9997</CODE></P> <P>You can also create a new index while on this server (I'd recommend doing so)</P> <P>Now go back to the server where you installed the Splunk forwarder, go under <CODE>$SPLUNK_HOME/etc/apps/search/local</CODE> and create 2 files.. The first file is called <CODE>inputs.conf</CODE> and the second file will be called <CODE>outputs.conf</CODE></P> <P>Inputs.conf</P> <PRE><CODE>[monitor://PATH_TO_YOUR_LOG_FILE] index=YOUR_INDEX_NAME sourcetype=YOUR_SOURCETYPE </CODE></PRE> <P>Outputs.conf</P> <PRE><CODE>[tcpout] defaultGroup = default-autolb-group [tcpout:default-autolb-group] disabled = false server = YOUR_INDEXER_IP_ADDRESS:9997 </CODE></PRE> <P>Restart Splunkd on the forwarder after making these changes by going to <CODE>$SPLUNK_HOME/bin</CODE> and <CODE>./splunk restart</CODE></P> <P><A href="http://docs.splunk.com/Documentation/Splunk/6.5.2/Data/Getstartedwithgettingdatain">http://docs.splunk.com/Documentation/Splunk/6.5.2/Data/Getstartedwithgettingdatain</A></P> Tue, 28 Mar 2017 17:13:56 GMT skoelpin 2017-03-28T17:13:56Z https://community.splunk.com/t5/Getting-Data-In/How-to-send-visual-studio-application-log-to-Splunk-Enterprise/m-p/303462#M57287 <P>I have installed Splunk Enterprise. Need to know the basic steps to send log data from my standalone visual studio application.</P> Tue, 28 Mar 2017 16:41:15 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-send-visual-studio-application-log-to-Splunk-Enterprise/m-p/303462#M57287 j_rajesh 2017-03-28T16:41:15Z https://community.splunk.com/t5/Getting-Data-In/How-to-send-visual-studio-application-log-to-Splunk-Enterprise/m-p/303463#M57288 <P>I'm assuming Splunk is installed on a separate server that visual studio is installed on?</P> <P>If so then install a Splunk Universal Forwarder on the server with visual studio. Once installed, go back to the server where Splunk is installed and configure it to receive traffic via port 9997 by <CODE>Settings &gt; Forwarding and Receiving &gt; Configure Receiving &gt; New &gt; Add 9997</CODE></P> <P>You can also create a new index while on this server (I'd recommend doing so)</P> <P>Now go back to the server where you installed the Splunk forwarder, go under <CODE>$SPLUNK_HOME/etc/apps/search/local</CODE> and create 2 files.. The first file is called <CODE>inputs.conf</CODE> and the second file will be called <CODE>outputs.conf</CODE></P> <P>Inputs.conf</P> <PRE><CODE>[monitor://PATH_TO_YOUR_LOG_FILE] index=YOUR_INDEX_NAME sourcetype=YOUR_SOURCETYPE </CODE></PRE> <P>Outputs.conf</P> <PRE><CODE>[tcpout] defaultGroup = default-autolb-group [tcpout:default-autolb-group] disabled = false server = YOUR_INDEXER_IP_ADDRESS:9997 </CODE></PRE> <P>Restart Splunkd on the forwarder after making these changes by going to <CODE>$SPLUNK_HOME/bin</CODE> and <CODE>./splunk restart</CODE></P> <P><A href="http://docs.splunk.com/Documentation/Splunk/6.5.2/Data/Getstartedwithgettingdatain">http://docs.splunk.com/Documentation/Splunk/6.5.2/Data/Getstartedwithgettingdatain</A></P> Tue, 28 Mar 2017 17:13:56 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-send-visual-studio-application-log-to-Splunk-Enterprise/m-p/303463#M57288 skoelpin 2017-03-28T17:13:56Z