Splunk Universal Forwarder

[heykumaran]

Hello,

I installed my Splunk Universal Forwarder in CentOS Server. and started the client on the server..

i get this message

Checking prerequisites...
Checking mgmt port [8089]: open
Checking conf files for typos... Done
All preliminary checks passed.

Starting splunk server daemon (splunkd)... Done

Then how i setup in the Splunk Server to receive logs?

Help me?

[sdaniels]

Here is the link in the docs for setting up receiving on the Splunk server.

http://docs.splunk.com/Documentation/Splunk/5.0.3/Deploy/Enableareceiver

Once you do that you'll want to read this for configuring inputs.conf on the forwarder to begin bringing data into splunk.

http://docs.splunk.com/Documentation/Splunk/5.0.3/Data/Usingforwardingagents

[sdaniels]

You aren't going to see it with that admin interface of Splunk. Once you configure something to be monitored and the data gets to the Splunk server you'll start seeing data in the Search app within splunk from that host.

Take a few minutes to read the docs and it'll be very easy.

http://docs.splunk.com/Documentation/Splunk/5.0.3/Data/Editinputs.conf

[heykumaran]

Thanks
i did (Set up receiving with Splunk Web) and restarted the Splunk server... but i didn't see the client (CentOS) data on the website?

Helop me?

[Ayn]

This is essentially you asking "how does Splunk work"? http://docs.splunk.com/Documentation/Splunk/latest/Data/WhatSplunkcanmonitor