All Apps and Add-ons

Manually configuring Splunk App for Infrastructure

New Member

Hello, I have a working Splunk Enterprise and Splunk Universal Forwarder. I am using 2 different CentOS VM Instance. I can successfully forward logs from UF to SE. I can also do search in here. Although I wanted to do metrics using Splunk App for infrastructure. I'm quite new to splunk and kind of a bit confused on this part of installation.

I installed Splunk App in SE, then installed the Add-on on both SE and UF. I tried the automatic installed using the generated linux command but unfortunately, after downloading that.. my SE Entities are still empty. I've been trying these so many times so now I'm just trying to install in manually.

I am following this: Although I wanted to ask if I need to install again a separate UF from this SAI basing from step 1? or the previous step that I did is already enough? (My currently working SE and UF).

Furthermore, where should I alter the inputs.conf and outputs.conf? Should it be in the existing UF, additional UF or to the existing SE?

I've been struggling with this for quite some time now.. thank you in advance for any help!

0 Karma
Get Updates on the Splunk Community!

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...

Observability Newsletter Highlights | March 2023

 March 2023 | Check out the latest and greatestSplunk APM's New Tag Filter ExperienceSplunk APM has updated ...

Security Newsletter Updates | March 2023

 March 2023 | Check out the latest and greatestUnify Your Security Operations with Splunk Mission Control The ...