Getting Data In

Basic steps to configure universal forwarder (4.2)

No migrations, no upgrade, installing forwarders from the ground up.

from splunkd.log

**ERROR TcpOutputProc - LightWeightForwarder/UniversalForwarder not configured. Please configure outputs.conf**

etc/system/local/outputs.conf

[tcpout]
defaultGroup = splunk
server = log1:9997
compressed=true

etc/system/local/deploymentclient.conf

[target-broker:deploymentServer]
targetUri = log1:9997

etc/system/local/inputs.conf

[monitor:///[my folder path]/splunk-test]
disabled = false
followTail = 0
index = default

Splunk on log1 works fine.

Tags (1)
1 Solution

Communicator

I think the issue is that you don't have a stanza corresponding to your defaultGroup. According to the docs, in that case you are disabling automatic forwarding.

I would make your output.conf look more like:

[tcpout]
defaultGroup = splunk

[tcpout:splunk]
disabled = false
server = log1:9997
compressed = true

View solution in original post

Communicator

I think the issue is that you don't have a stanza corresponding to your defaultGroup. According to the docs, in that case you are disabling automatic forwarding.

I would make your output.conf look more like:

[tcpout]
defaultGroup = splunk

[tcpout:splunk]
disabled = false
server = log1:9997
compressed = true

View solution in original post

Anybody? All I want to have universal forwarder forward log files to a central installation of Splunk on a different host. I noticed some other "forwarder" questions are not answered here. Nobody knows how they work?

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!