How to configure Splunk Forwarder inputs.conf on multiple Windows clients (no Forwarder Management option shown)

[Sam_Kurdy]

Hello everyone,

I have a small lab environment with one Windows Server (running Splunk Enterprise Trial) and three Windows client machines.
I’ve installed the Splunk Universal Forwarder on all clients, and I want to configure their inputs.conf files — but I don’t want to edit them manually one by one.

As an administrator, I was trying to use Forwarder Management from Splunk Web, but in my trial setup the option does not appear under “Settings.”
How can I centrally configure or push the same inputs.conf to all client forwarders in this situation?
Is there an alternative way to do this manually or via another configuration method?

Thank you in advance for any advice!

[isoutamo]

Here is Splunk's instructions for use DS currently named Client management or something similar https://help.splunk.com/en/splunk-enterprise/administer/update-your-deployment/9.4/deployment-server...

It needs that you have some apps defined for deploy to your clients. The easiest way to do it is just create e.g. Splunk App for collecting some WindowEvents from UF. Then install it in your server under /opt/splunk/etc/deployment-apps and restart your splunk instance. After that there should be Forwarder management in your Settings menu.

[Sam_Kurdy]

Thank you for your mention — that’s okay now, it works fine

[thahir]

@Sam_Kurdy 

yes its possible through the Splunk Deployment Server,

Enable the Deployment server on the server on your splunk home bath under bin dir

splunk enable deploy-server

Splukn restart

This is the switch that makes Forwarder Management show up in the UI.

On each client execute the below command

set deploy-poll <YourDeploymentServerFQDN>:8089 -auth admin:<password>

then restart the service, basically it will create the deploymentclient.conf on the client machine and it will include the below details

[deployment-client]
[target-broker:deploymentServer]
targetUri = <YourDeploymentServerFQDN>:8089

you can refer the below URL for more details,

https://help.splunk.com/en/splunk-enterprise/administer/update-your-deployment/9.0/configure-the-dep...

Let me know if you need any additional help on this.

[Sam_Kurdy]

Dear @thahir 

Thank you for your reply!

Actually, I tried all the steps you mentioned, but the Forwarder Management option still doesn’t appear in my Splunk Web interface.
I’m using the Splunk Enterprise Trial version [ Splunk Enterprise Server 10.0.1].

Please check the screenshot — maybe I’m missing something or it’s related to the trial version settings?

Thanks again for your help! 🙏

[thahir]

@Sam_Kurdy  Can you click on Agent management from 10.0 version onwards Forwarder Management renamed as Agent management 

ref: https://help.splunk.com/en/splunk-enterprise/administer/update-your-deployment/10.0/agent-management...