Deployment Architecture

Universal Forwarder

rajiv_r
Explorer

I am having Splunk self-service cloud deployment and trying to install the UF(Universal forwarder). After installing forwarder and universal forwarder credentials, I could not able to see the forwarders. I have an access to the server where the forwarder is installed and also restarted the Splunk server many times, but still I could not see the installed forwarder.

Note- I installed the splunk cloud instance trialled version . There I could installed the forwardersuccessfully but could not able to push the windows log to splunk. The receiving port (9997)configuration option is not available.

Please help in resolving these issues.

Tags (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @rajiv_r,
after you installed the Universal Forwarder on a target server, you have to configure it.
If you have a Deployment Server you have to copy the file deploymentclient.conf on $SPLUNK_HOME/etc/system/local, or in a dedicated app or to run the following commands

splunk set deploy-poll <IP_address/hostname>:<management_port>
splunk restart

for more details see at https://docs.splunk.com/Documentation/Splunk/8.0.0/Updating/Configuredeploymentclients
Then you have to add information about indexers to send data.

If you use Splunk Cloud, usually, there are one or two Heavy Forwarders that concentrate logs to send to Splunk Cloud.

So My hint is to analyze yur requirements and design you architecture, before install Universal Forwarders.

Ciao.
Giuseppe

0 Karma

woodcock
Esteemed Legend

After install the UF, you have to somehow (DS or manually) create an inputs.conf to tell it WHAT to send and an outputs.conf to tell it WHERE to send. You also have to make sure that there is a route from the UF to the Indexers and that there are firewall ACL rules to allow the traffic.

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...