All Apps and Add-ons

Universal Forwarder input not working

New Member

Hi, I have a dev windows 10 64bit environment with Splunk Enterprise and a Universal Forwarder and I'm trying to use File Metadata App to send data from UF to Splunk Ent locally (I'm testing the app).

I copied the app folder into the UF etc/apps folder, added an input configuration like the following and restarted but I'm not receiving data on my splunk enterprise endpoint:


However I'm sure the UF work fine, because if i set a simple monitoring configuration (a folder with a csv file) using the following configuration I recieve data from UF on main index.

disabled = false
index = main"

I have Python 2.7.1 installed on the machine (and also Python 3).

I tried more time, restarting, changing configuration and more, but it does nothing.

Can you help me?

Do you have a guide to install and configure step by step the app on a Universal Forwarder (for windows environment) or some suggestions?

Thanks a lot.


0 Karma
Get Updates on the Splunk Community!

Devesh Logendran, Splunk, and the Singapore Cyber Conquest

At this year’s Splunk University, I had the privilege of chatting with Devesh Logendran, one of the winners in ...

There's No Place Like Chrome and the Splunk Platform

WATCH NOW!Malware. Risky Extensions. Data Exfiltration. End-users are increasingly reliant on browsers to ...

Customer Experience | Join the Customer Advisory Board!

Are you ready to take your Splunk journey to the next level? 🚀 We invite you to join our elite squad ...