topic Re: How to configure Universal Forwarder on my personal machine where Splunk Enterprise is installed for learning purpose? in Getting Data In

How to configure Universal Forwarder on my personal machine where Splunk Enterprise is installed for learning purpose?

ashishmaind2499 — Fri, 11 May 2018 10:40:02 GMT

I installed Splunk Universal Fwd and Splunk Enterprise on my C drive. I created a sample file and modified the inputs.conf as mentioned in one of the ans(link given below) and enabled the receiver by setting port to 9997. Do we have to modify/create outputs.conf file? I tried creating outputs.conf too..but no use. In outputs.conf I gave the server name as localhost and port as 9997. Am I missing something? Also, do we have to modify anything in distributed search? I assume my Splunk Enterprise is acting both as SH and Indexer.
Have referred to below ans but didnt got the answer
https://answers.splunk.com/answers/490343/how-to-properly-configure-universal-forwarder-loca.html#answer-656030

Re: How to configure Universal Forwarder on my personal machine where Splunk Enterprise is installed for learning purpose?

jkat54 — Fri, 11 May 2018 12:08:12 GMT

Please share your inputs.conf and outputs.conf.

Also check if firewall is blocking any ports please.

Re: How to configure Universal Forwarder on my personal machine where Splunk Enterprise is installed for learning purpose?

xpac — Sat, 12 May 2018 13:34:44 GMT

If you're running both on the same system, you might run into trouble because, by default, both want to listen on TCP 9997.
Check if both instances actually run, you might have to change the splunkd port of the UF using server.conf.