Deployment Architecture
Highlighted

Question of forwarding

New Member

We are running Splunk 4.1.7 version, We have a Splunk Indexer in non windows environment. We have all the other servers running light weight forwarders to forward the alerts to the Indexer.

After installing the light weight forwarder as below:

msiexec.exe /i splunk-4.1.7-95063-x86-release.msi SPLUNK_APP="SplunkLightForwarder" FORWARD_SERVER="splunkserver:9997" /quiet

Do I have to configure anything in the receiving section in the Manager option or once the install is done, will all those light weight forwarders start forwarding the alerts?

0 Karma
Highlighted

Re: Question of forwarding

Splunk Employee
Splunk Employee

So long as your indexer is configured as a receiver for port 9997, you shouldn't need to do anything else. If it is not, you'll need to take that step.

http://www.splunk.com/base/Documentation/latest/Deploy/Enableareceiver

0 Karma