Having trouble getting started

[dc18]

I installed spunk enterprise on a server named s1.  I installed a forwarder on server f1.

Both Windows Server 2019.

When I go into Forwarder Management, s1 sees f1, but I can't DO anything with it.  There's nothing on the Forwarder Management screen to CONFIGURE.  

If I go to Settings | Data Inputs and try to configure "Remote Performance monitoring" (just as a test, just to monitor something), it says it's going to use WMI and that I should use a forwarder instead.

Yes, please.  I want to use a forwarder instead.  I want to user my new forwarder, but I just don't see how.

[dc18]

It's working.  I just added my second forwarder.  Thanks again!

[richgalloway · Accepted solution]

The Forwarder Management screen applies only to Deployment Server (DS) instances.  A DS is a Splunk instance type that ensures each forwarder has the configuration (apps) it needs.  DSs are optional and are unnecessary when you only have a single forwarder.

When you installed the forwarder, did you configure it to forward data to the server?  If so, then you should be seeing data from the forwarder.  Verify that by searching for

index=_internal host=f1

Make sure that returns results for continuing further.

The next step is telling the forwarder what you want it to forward.  By default, it only sends its own logs.  Install the Splunk Add-on for Windows (https://splunkbase.splunk.com/app/742) on the forwarder and turn on (set disabled=0) the inputs you desire.  Be sure to restart the forwarder after changing inputs.conf settings.

[dc18]

I haven't tried this yet but it sounds very helpful.  I'm going to try it later this afternoon.

Thank you!