All Apps and Add-ons

How do I install it in Universal Forwarder?

charleslcso
Explorer

I have machines that has only the Universal Forwarder installed. How to I install and configure Splunk for *nix to run on these machines and forward data to the Indexer?

0 Karma
1 Solution

dwaddle
SplunkTrust
SplunkTrust

You can install the app simply by exploding the .tar.gz into $SPLUNK_HOME/etc/apps. To configure it, you will need to update some local config files to enable the various inputs.

The easiest way to configure might be to install an lightweight forwarder with Splunk for *nix, go through the configuration panels there, and then use the updated app with configuration files to deploy to your Universal forwarders.

View solution in original post

dwaddle
SplunkTrust
SplunkTrust

You can install the app simply by exploding the .tar.gz into $SPLUNK_HOME/etc/apps. To configure it, you will need to update some local config files to enable the various inputs.

The easiest way to configure might be to install an lightweight forwarder with Splunk for *nix, go through the configuration panels there, and then use the updated app with configuration files to deploy to your Universal forwarders.

charleslcso
Explorer

Do I make a directory copy of $SPLUNK_HOME/etc/apps to the Universal Forwarder's $SPLUNK_HOME/etc/apps?

I am thinking of using and configuring a test machine as you suggested.

0 Karma
Get Updates on the Splunk Community!

SOC4Kafka - New Kafka Connector Powered by OpenTelemetry

The new SOC4Kafka connector, built on OpenTelemetry, enables the collection of Kafka messages and forwards ...

Your Voice Matters! Help Us Shape the New Splunk Lantern Experience

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Building Momentum: Splunk Developer Program at .conf25

At Splunk, developers are at the heart of innovation. That’s why this year at .conf25, we officially launched ...