Can i use splunk universal forwarder with free splunk enterprise ?

[Pryshepa]

Hello guys im noob so xD sorri ! Can i use splunk universal forwarder with free splunk enterprise ? If yes, wher i can get Host url for for conect slunk enterprise on my pc with universal forwarder on other pc? thx for reading this @_@ silly question >.<

[tiagofbmm]

Hi

Yes you can use a Splunk Universal Forwarder with Splunk Free. The host of where you are placing the UF, it has to be you to find that out as it is your environment.

After getting that hostname, go to your Splunk Enterprise,->Settings->Data Inputs-> TCP and open a port to receive data from your Universal Forwarder.

Then go to your Universal Forwarder and set up an outputs.conf in an app you want, like this

outputs.conf under $SPLUNK_HOME/etc/apps/app_you_want

[tcpout]
defaultGroup = primary_indexers

[tcpout:primary_indexers]
server = <your Splunk Enterprise Host Name>:<the port you just opened in the Splunk Enterprise>,

[shandr]

In later versions, Splunk Enterprise,->Settings->Forwarding and receiving->Configure receiving. e.g. 7.3.5.

[p_gurav · Accepted solution]

Hi,

Yes, you can configured forwarder. You can take help of this document:
http://docs.splunk.com/Documentation/Forwarder/7.0.2/Forwarder/HowtoforwarddatatoSplunkEnterprise

[deepashri_123]

Hey Pryshepa,

Yes you can use Splunk Forwarder with free splunk enterprise.
But you cannot use clustered environment.
Hope this helps!!