Can't manage the data that is getting forwarded to my Splunk Instance

[ckunath]

Hello,

a forwarder has been set up to send data to my linux machine and I get the data, everything is fine so far.
The problem is, that the person who set up the forwarder did not specify the right source type, and for some reason I can't find the data input under "Data inputs" to edit it.
If I want to go to Add Data > Forward it tells me that "There are currently no forwarders configured as deployment clients to this instance."

Can anyone tell me how I can set up my splunk enterprise instance so that I can manage the inputs from the forwarder on my end?

Thanks in advance!

[brreeves_splunk · Accepted solution]

@ckunath,

You'll need to find out what the inputs.conf file looks like on the actual forwarder so that you know what to put into the deployment app you'll create. Here's the basics: http://docs.splunk.com/Documentation/Splunk/6.5.3/Updating/Aboutdeploymentserver

You'll tell the forwarder to look to the main instance using this splunk set deploy-poll command.
http://docs.splunk.com/Documentation/Splunk/6.5.3/Updating/Configuredeploymentclients

Next, you'll create a deployment app that has an inputs.conf that you want the forwarder to follow.
http://docs.splunk.com/Documentation/Splunk/6.5.3/Updating/Createdeploymentapps

And finally, you'll assign the app you created with the inputs.conf to the server class you created that includes the forwarder you mentioned.
http://docs.splunk.com/Documentation/Splunk/6.5.3/Updating/Definedeploymentclasses

[dineshraj9]

You have to check the forwarder and find the inputs.conf file on the forwarder and modify it.
You can get the installation path by checking the directory of the forwarders internal log.

[brreeves_splunk]

While they will need to find the inputs.conf on the forwarder, the question was "How do I manage it remotely?".