Getting Data In

Can you use Splunk universal forwarder to forward data to Splunk Enterprise ran locally?

denzelchung
Path Finder

I am trying to get an Universal Forwarder installed on a server to forward some logs data to my Splunk Enterprise that is running on localhost (not hosted on any server).
Is this possible?
If I forward the data from the Universal Forwarder to my host's IP address and enable receiving, will it work?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

If I understand the question correctly, you have Splunk Enterprise and Universal Forwarder running on the same server. This is not necessary. Splunk Enterprise can monitor files itself so there's no need for a forwarder on the same server.

---
If this reply helps you, Karma would be appreciated.

denzelchung
Path Finder

Sorry if it is unclear. The Universal Forwarder is going to be installed on a different server and it is forwarding data to my laptop as a proof of concept.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Thanks for clarifying. You will need to enable Splunk on your laptop to receive data on port 9997 (default). Go to Settings->Forwarding and Receiving to do that. You'll probably need to open a hole in your firewall, too. Then put your laptop's IP address in the forwarder's outputs.conf file, restart, and you should see data.

---
If this reply helps you, Karma would be appreciated.
0 Karma

effem
Communicator

Depending on how your networking is set up and if the Splunk Instance on your machine is bind to your "external" IP.

However, it is not recommended to send data unsecured/unencrypted over the internet.

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...