topic Re: How can I send data from another machine to the machine running splunk Universal forwarder and then have the forwarder send it to the machine running the receiver? in Getting Data In

How can I send data from another machine to the machine running splunk Universal forwarder and then have the forwarder send it to the machine running the receiver?

epeeran — Tue, 27 Nov 2012 18:10:08 GMT

I have a Linux server running the universal forwarder I want another server send data to it and then have the forwarder redirect this data to the splunk receiver server

Re: How can I send data from another machine to the machine running splunk Universal forwarder and then have the forwarder send it to the machine running the receiver?

lguinn2 — Tue, 27 Nov 2012 18:57:39 GMT

Getting data to the server running the Universal Forwarder is not part of Splunk. That said, a lot of people use syslog for things like this. Why can't the other machine also have the Universal Forwarder running on it?

Re: How can I send data from another machine to the machine running splunk Universal forwarder and then have the forwarder send it to the machine running the receiver?

rsennett_splunk — Sat, 30 Mar 2013 00:11:26 GMT

The Universal Forwarder has an inputs.conf just like the indexer.

You then tell the UF via inputs.conf where to look for it or listen for the data coming in.
As Lisa said, you can get it there any way you like.

It will then forward the data to the receiver following the configuration in outputs.conf

If getting the the new data to the current UF is complicated (ie, you'd have to write a script yourself, you don't want to use syslog, etc) consider putting another instance of UF where the data lives.

If you need to use another UF to send the data to your current forwarder you will set up your existing forwarder (the one that will send to the indexer) as an Intermediate Forwarder which will both forward and receive.

NEW UF(sender) -------------->(receiver) EXISTING UF (sender) ---------->INDEXER (receiver)

Since there is no web interface on the Universal Forwarder you have to set it up via the command line (which writes to the inputs.conf) or you can edit inputs.conf and add the stanza like this:
[splunktcp://9997]

The benefit there of course is that Splunk will now keep track of what has been sent and received in the event of a network outage.

All of this is nicely documented, step by step for every scenario. You can start reading here:

http://docs.splunk.com/Documentation/Splunk/5.0.2/Deploy/Introducingtheuniversalforwarder