Getting Data In

Do we need to install Splunk Light in both Windows and Linux to forward data from remote hosts?

Monica7
New Member

Hi,

I have installed Splunk light in Windows and in Linux server also. I have installed a universal forwarder in the same Linux machine.

In Splunk Light web page, Data - > Add Data -> receiving -> new. I have added port as 9997

and in Linux server,

I have added forward server and deploy server in Splunk universal forwarder with the following commands.

./splunk add forward-server mysystemip:9997

and ./splunk set deploy-poll mysystemip:8089

and started the universal forwarder and Splunk.

[s249635@CTSC00621983301 ~]$ ps -ef|grep splunk
s249635   2994     1  0 13:53 ?        00:00:03 splunkd -p 8089 start
s249635   2995  2994  0 13:53 ?        00:00:00 [splunkd pid=2994] splunkd -p 8089 start [process-runner]
s249635   3054  2995  0 13:53 ?        00:00:05 /home/s249635/splunk/bin/python -O /home/s249635/splunk/lib/python2.7/site-packages/splunk/appserver/mrsparkle/root.py --proxied=127.0.0.1,8065,8000
s249635   3096  2995  0 13:53 ?        00:00:00 /home/s249635/splunk/bin/splunkd instrument-resource-usage -p 8089
s249635   3329     1  0 14:04 ?        00:00:03 splunkd -p 9997 restart
s249635   3330  3329  0 14:04 ?        00:00:00 [splunkd pid=3329] splunkd -p 9997 restart [process-runner]
s249635   3606  3579  0 14:19 pts/0    00:00:00 grep splunk
[s249635@CTSC00621983301 ~]$

Now both are up and running. In Splunk Web, I have my Linux machine in the available host list in Add data ->forward -> select forwarders.

I have mentioned the path where logs need to be tracked in Splunk Web.

Question is whether any other configurations have to be done apart from this in order to forward data from remote hosts/server?

0 Karma

andrewb_splunk
Splunk Employee
Splunk Employee

See the topics in the Getting Data In chapter of the Splunk Light User Guide. The topic About adding data to Splunk Light is a good starting point with links to more specific procedures.

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...