Forwarder - Please Clarify Usage

[dejager]

Ok I am lost.
I have a universal forwarder installed on a Win server
I have the Splunk Web Interface (on separate server) in which I can see the forwarder (Settings -> Forwarder Manager)
Now this newbie question: How do I use the data in search - I suspect that I need to add Data, my question is how.
I did have a look in the documentation but could not see the answer.

[lukejadamec · Accepted solution]

When you installed the forwarder on the Win server you should have entered the ip address for the indexer, and you should have selected the eventlogs that you want Splunk to index.

If you did that, then you can start searching by entering the following in the search app, and from the time picker select all time:

index=main

On the left side of the screen you will see a list of fields with top 10 values per field. You can use those to narrow your search.

You really should read the docs, and perhaps take a tutorial or two.

[dejager]

Ok found the problem.
And yes - I did read the documentation before, what I did miss is that the Window install points the input to port 9997 and that you have to manually fix the the input.conf (C:\SplunkUniversalForwarder\etc\apps\SplunkUniversalForwarder\default).

Thanks for the assist

[Ayn]

Sounds to me you should be reading the docs: http://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Aboutforwardingandreceivingdata

You need to configure inputs on your forwarder. It won't automatically read and forward any data so you need to tell it what to grab.

[dejager]

Here is what is confusing.
1) I can see the forwarder | Settings -> Forwarder Management

2) In Search -> What to Search (Data Summary), the host from where the data is being send by the forwarder is not being shown.

As I understand Splunk - I need to see the data before I can search and I am not seeing the forwarders data