topic Can you use Splunk universal forwarder to forward data to Splunk Enterprise ran locally? in Getting Data In

Can you use Splunk universal forwarder to forward data to Splunk Enterprise ran locally?

denzelchung — Tue, 25 Jun 2019 09:10:33 GMT

I am trying to get an Universal Forwarder installed on a server to forward some logs data to my Splunk Enterprise that is running on localhost (not hosted on any server).
Is this possible?
If I forward the data from the Universal Forwarder to my host's IP address and enable receiving, will it work?

Re: Can you use Splunk universal forwarder to forward data to Splunk Enterprise ran locally?

effem — Tue, 25 Jun 2019 09:32:09 GMT

Depending on how your networking is set up and if the Splunk Instance on your machine is bind to your "external" IP.

However, it is not recommended to send data unsecured/unencrypted over the internet.

Re: Can you use Splunk universal forwarder to forward data to Splunk Enterprise ran locally?

richgalloway — Tue, 25 Jun 2019 12:30:43 GMT

If I understand the question correctly, you have Splunk Enterprise and Universal Forwarder running on the same server. This is not necessary. Splunk Enterprise can monitor files itself so there's no need for a forwarder on the same server.

Re: Can you use Splunk universal forwarder to forward data to Splunk Enterprise ran locally?

denzelchung — Tue, 25 Jun 2019 13:56:34 GMT

Sorry if it is unclear. The Universal Forwarder is going to be installed on a different server and it is forwarding data to my laptop as a proof of concept.

Re: Can you use Splunk universal forwarder to forward data to Splunk Enterprise ran locally?

richgalloway — Tue, 25 Jun 2019 16:41:52 GMT

Thanks for clarifying. You will need to enable Splunk on your laptop to receive data on port 9997 (default). Go to Settings->Forwarding and Receiving to do that. You'll probably need to open a hole in your firewall, too. Then put your laptop's IP address in the forwarder's outputs.conf file, restart, and you should see data.