topic While Installing Splunk forwarder in windows, what IP address should be used for receiving indexer? in Installation

While Installing Splunk forwarder in windows, what IP address should be used for receiving indexer?

sg17 — Tue, 24 Nov 2020 05:55:58 GMT

while Installing Splunk forwarder in windows, what IP address should be used for receiving indexer?

Is it my Windows IP address?

The browser for Splunk in showing localhost address 127.0.0.1

Re: Installing splunk forwarder in windows

vikramyadav — Mon, 23 Nov 2020 04:07:02 GMT

127.0. 0.1 is the loopback Internet protocol (IP) address also referred to as the localhost. The address is used to establish an IP connection to the same machine or computer being used by the user.

This is not your windows ip.

Refer to this blog to check your windoes Ip.

https://networking.grok.lsu.edu/article.aspx?articleid=14842&printable=y

-------------------------------------

If this helps your like will be appreciated 🙂

Re: Installing splunk forwarder in windows

nwuest — Mon, 23 Nov 2020 07:14:51 GMT

Hi @sg17,

A receiving indexer is a Splunk Enterprise instance that is set up as an Indexer to receive logs from other Splunk instances (Splunk Universal Forwarder / Heavy Forwarder / Splunk Enterprise)

A Splunk Universal Forwarder only has the essential components to forward data to other Splunk platform instances (Splunk Heavy Forwarder / Splunk Enterprise)

Are you installing a Splunk Universal Forwarder at home or at work?

If you are at home, you can install/configure a Splunk Enterprise instance as an indexer to receive logs from your Splunk Universal Forwarder.
Download Splunk Enterprise

Here is the Splunk documentation on getting data in
Splunk® Enterprise Getting Data In
If you are at work, does your work have a Splunk Instance to send logs into or use Splunk as their SIEM?

We look forward to hearing from you!

V/R,
nwuest

Re: Installing splunk forwarder in windows

sg17 — Mon, 23 Nov 2020 17:49:42 GMT

I am installing at home.

What ip address should I use ? Is it my laptop's ip address

Re: Installing splunk forwarder in windows

vikramyadav — Mon, 23 Nov 2020 17:54:31 GMT

You don't have to use any IP by default it will take your IP address. Yes, it will be your laptop IP address.

--------------------------------------

If this helps your like will be appreciated😊

Re: Installing splunk forwarder in windows

sg17 — Tue, 24 Nov 2020 00:38:11 GMT

I have tried using my IP address but splunk is not showing my laptop in Data summary

Re: Installing splunk forwarder in windows

nwuest — Tue, 24 Nov 2020 03:06:44 GMT

Hi @sg17,

I see you are installing the Splunk Universal Forwarder at home. I also see that you are having trouble with your most recent reply that you are not seeing any data in the "Data Summary" in the Search and Reporting app.

I'm a little confused because you say you are setting up a Splunk Universal Forwarder but a Forwarder comes with the web interface disabled.
A Splunk Enterprise instance does come with a web interface enabled, which makes me think that you are running this and not a universal forwarder.
- You don't need to set an IP for a "receiving indexer" in this solution.
  If you are just trying to look at logs on your local Windows machine with a default Splunk Enterprise install, it will only ingest its own "Splunk" logs (Which come into the "_internal" index.)
  
  If you would like to see more logs on the local machine, please look into installing the Splunk Add-on for Windows app to get more Windows related data.
  Splunk Add-on for Microsoft Windows
  Or you can do some one-off's and look at a single log if wanted.
  Monitor data

Do look forward to hearing back from you!

V/R,
nwuest