topic Re: splunk universal forwarder in Installation

splunk universal forwarder

iherb_0718 — Wed, 20 Jan 2021 03:17:33 GMT

Hi,

My environment consists of a deployment server and Heavy Forwarders.

The Windows Server clients have a Universal forwarder sending to the Heavy Forwarder. Can someone tell me where the configuration file is within the Windows server that tells it which heavy forwarder to send the data to?

Re: splunk universal forwarder

scelikok — Wed, 20 Jan 2021 05:04:30 GMT

Hi @iherb_0718,

On Windows Universal Forwarder you should check for outputs.conf file. That should be being managed by an app on Deployment servers $SPLUNK_HOME/etc/deployment_apps folder.

On Windows Universal Forwarder you can run btool to find outputs.conf file path. Please run below command on #SPLUNK_HOME path of windows (default path is %PROGRAMFILES%\SplunkUniversalForwarder)

%PROGRAMFILES%\SplunkUniversalForwarder\bin\splunk btool outputs list --debug

From above command output you can see which outputs.conf to check on deployment server.

If this reply helps you an upvote is appreciated.

Re: splunk universal forwarder

iherb_0718 — Wed, 20 Jan 2021 16:29:58 GMT

Hi Scelikok. I'm on a windows server and the install folder is in C:\Program Files\SplunkUniversalForwarder

I searched this folder for outputs.conf but when I open it, I don't see my heavy forwarder server. I'm trying to find out which heavy forwarder this server is configured for.

Assume I don't have access to the deployment server at this time.

Re: splunk universal forwarder

iherb_0718 — Wed, 20 Jan 2021 16:40:06 GMT

my mistake. i see it in the outputs.conf. thank you