Getting Data In

Can you use Splunk universal forwarder to forward data to Splunk Enterprise ran locally?

denzelchung
Path Finder

I am trying to get an Universal Forwarder installed on a server to forward some logs data to my Splunk Enterprise that is running on localhost (not hosted on any server).
Is this possible?
If I forward the data from the Universal Forwarder to my host's IP address and enable receiving, will it work?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

If I understand the question correctly, you have Splunk Enterprise and Universal Forwarder running on the same server. This is not necessary. Splunk Enterprise can monitor files itself so there's no need for a forwarder on the same server.

---
If this reply helps you, Karma would be appreciated.

denzelchung
Path Finder

Sorry if it is unclear. The Universal Forwarder is going to be installed on a different server and it is forwarding data to my laptop as a proof of concept.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Thanks for clarifying. You will need to enable Splunk on your laptop to receive data on port 9997 (default). Go to Settings->Forwarding and Receiving to do that. You'll probably need to open a hole in your firewall, too. Then put your laptop's IP address in the forwarder's outputs.conf file, restart, and you should see data.

---
If this reply helps you, Karma would be appreciated.
0 Karma

effem
Communicator

Depending on how your networking is set up and if the Splunk Instance on your machine is bind to your "external" IP.

However, it is not recommended to send data unsecured/unencrypted over the internet.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...