Basic steps to configure universal forwarder (4.2)

[yuriy_zubarev]

No migrations, no upgrade, installing forwarders from the ground up.

from splunkd.log

**ERROR TcpOutputProc - LightWeightForwarder/UniversalForwarder not configured. Please configure outputs.conf**

etc/system/local/outputs.conf

[tcpout]
defaultGroup = splunk
server = log1:9997
compressed=true

etc/system/local/deploymentclient.conf

[target-broker:deploymentServer]
targetUri = log1:9997

etc/system/local/inputs.conf

[monitor:///[my folder path]/splunk-test]
disabled = false
followTail = 0
index = default

Splunk on log1 works fine.

[mslvrstn · Accepted solution]

I think the issue is that you don't have a stanza corresponding to your defaultGroup. According to the docs, in that case you are disabling automatic forwarding.

I would make your output.conf look more like:

[tcpout]
defaultGroup = splunk

[tcpout:splunk]
disabled = false
server = log1:9997
compressed = true

[yuriy_zubarev]

Anybody? All I want to have universal forwarder forward log files to a central installation of Splunk on a different host. I noticed some other "forwarder" questions are not answered here. Nobody knows how they work?