How do I install it in Universal Forwarder?

[charleslcso]

I have machines that has only the Universal Forwarder installed. How to I install and configure Splunk for *nix to run on these machines and forward data to the Indexer?

[dwaddle · Accepted solution]

You can install the app simply by exploding the .tar.gz into $SPLUNK_HOME/etc/apps. To configure it, you will need to update some local config files to enable the various inputs.

The easiest way to configure might be to install an lightweight forwarder with Splunk for *nix, go through the configuration panels there, and then use the updated app with configuration files to deploy to your Universal forwarders.

[charleslcso]

Do I make a directory copy of $SPLUNK_HOME/etc/apps to the Universal Forwarder's $SPLUNK_HOME/etc/apps?

I am thinking of using and configuring a test machine as you suggested.