Confused about the data

[SLowry]

I've enabled Forwarding & Receiving to accept input from the Universal Forwarder that I installed on my servers. Using Wireshark I know data is being sent to the Splunk server. I'm confused about the next steps in terms of indexing the data. Where is it being stored on my server? Do I need to add files on the server? How does the data get to them?

Thanks

[Ayn · Accepted solution]

You add data inputs on the Universal Forwarders. The forwarders will read data from these inputs and forward that data to the main Splunk indexer. The indexer stores this data in its index, typically in $SPLUNK_HOME/var/lib/splunk, where $SPLUNK_HOME usually is /opt/splunk in *NIX installations and C:\Program Files\Splunk in Windows installations.

[SLowry]

Thanks. You got me moving in the right direction.

[DaveSavage]

Slowry - Ayn is right - post your q's re WI and Windows Mgmt as new q's - the tagging system works in your favour and you will be able to see 'related' if not similar q's people have had. The user experience on the App's release page makes for good reading at http://splunk-base.splunk.com/apps/22315/splunk-app-for-windows
Br, Dave

[Ayn]

That's a separate question regarding those specific apps - best idea would be to post that on its own and tag it correctly, so people with knowledge of those apps (I don't have that, sorry) can see and respond.

[SLowry]

OK, I see lots of data in the Main file. That's good.
I have Windows Intelligence & Windows Management Apps installed. How do I tell them to use the Main index? I see Indexes for WI, but they are empty, I don't think that's correct, but I don't know how to get the data to them.