Are you a member of the Splunk Community?
- Find Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- Re: Basic steps to configure universal forwarder (...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
No migrations, no upgrade, installing forwarders from the ground up.
from splunkd.log
**ERROR TcpOutputProc - LightWeightForwarder/UniversalForwarder not configured. Please configure outputs.conf**
etc/system/local/outputs.conf
[tcpout]
defaultGroup = splunk
server = log1:9997
compressed=true
etc/system/local/deploymentclient.conf
[target-broker:deploymentServer]
targetUri = log1:9997
etc/system/local/inputs.conf
[monitor:///[my folder path]/splunk-test]
disabled = false
followTail = 0
index = default
Splunk on log1 works fine.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I think the issue is that you don't have a stanza corresponding to your defaultGroup. According to the docs, in that case you are disabling automatic forwarding.
I would make your output.conf look more like:
[tcpout]
defaultGroup = splunk
[tcpout:splunk]
disabled = false
server = log1:9997
compressed = true
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I think the issue is that you don't have a stanza corresponding to your defaultGroup. According to the docs, in that case you are disabling automatic forwarding.
I would make your output.conf look more like:
[tcpout]
defaultGroup = splunk
[tcpout:splunk]
disabled = false
server = log1:9997
compressed = true
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Anybody? All I want to have universal forwarder forward log files to a central installation of Splunk on a different host. I noticed some other "forwarder" questions are not answered here. Nobody knows how they work?
Community Content Calendar, September edition
Splunkbase Unveils New App Listing Management Public Preview
Leveraging Automated Threat Analysis Across the Splunk Ecosystem
