Question of forwarding

[ppram]

We are running Splunk 4.1.7 version, We have a Splunk Indexer in non windows environment. We have all the other servers running light weight forwarders to forward the alerts to the Indexer.

After installing the light weight forwarder as below:

msiexec.exe /i splunk-4.1.7-95063-x86-release.msi SPLUNK_APP="SplunkLightForwarder" FORWARD_SERVER="splunkserver:9997" /quiet

Do I have to configure anything in the receiving section in the Manager option or once the install is done, will all those light weight forwarders start forwarding the alerts?

[jbsplunk]

So long as your indexer is configured as a receiver for port 9997, you shouldn't need to do anything else. If it is not, you'll need to take that step.

http://www.splunk.com/base/Documentation/latest/Deploy/Enableareceiver