Getting Data In

Can I configure defaultGroup when remotely deploying a *nix universal forwarder with a static configuration?


I am deploying universal forwarders with a bash script that is based on the sample script in

My issue is that defaultGroup is defaulted to "default-autolb-group" in splunkforwarder/etc/system/local/outputs.conf.

I would like to default defaultGroup to "splunkcloud" rather than "default-autolb-group". Is there a Splunk-specific way to do that?

This document mentions that there are CLI commands for customizing forwarding behavior, but I cannot find any detail beyond that:

I appreciate any help!

0 Karma


The following configuration for any splunk enterprise version (not for universal forwarder)

The below configuration send the data with sourcetype=mysourcetype to the indexer and remaining data to indexer.

Hope this configuration helps you.

TRANSFORMS-tcpfwd = sendtotcpreceiver



defaultGroup = default-group

[tcpout: default-group]
server =

[tcpout:tcpreceivergroup] <-- To Splunk indexer

0 Karma
Get Updates on the Splunk Community!

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...