Universal Forwarder

[rajiv_r]

I am having Splunk self-service cloud deployment and trying to install the UF(Universal forwarder). After installing forwarder and universal forwarder credentials, I could not able to see the forwarders. I have an access to the server where the forwarder is installed and also restarted the Splunk server many times, but still I could not see the installed forwarder.

Note- I installed the splunk cloud instance trialled version . There I could installed the forwardersuccessfully but could not able to push the windows log to splunk. The receiving port (9997)configuration option is not available.

Please help in resolving these issues.

[gcusello]

Hi @rajiv_r,
after you installed the Universal Forwarder on a target server, you have to configure it.
If you have a Deployment Server you have to copy the file deploymentclient.conf on $SPLUNK_HOME/etc/system/local, or in a dedicated app or to run the following commands

splunk set deploy-poll <IP_address/hostname>:<management_port>
splunk restart

for more details see at https://docs.splunk.com/Documentation/Splunk/8.0.0/Updating/Configuredeploymentclients
Then you have to add information about indexers to send data.

If you use Splunk Cloud, usually, there are one or two Heavy Forwarders that concentrate logs to send to Splunk Cloud.

So My hint is to analyze yur requirements and design you architecture, before install Universal Forwarders.

Ciao.
Giuseppe

[woodcock]

After install the UF, you have to somehow (DS or manually) create an inputs.conf to tell it WHAT to send and an outputs.conf to tell it WHERE to send. You also have to make sure that there is a route from the UF to the Indexers and that there are firewall ACL rules to allow the traffic.