How do I enable the universal forwarder?

[Steve_G_]

I've installed Splunk. Now, how do I turn it into a universal forwarder?

With light and heavy forwarders, I used to just enable them from inside Splunk, but I can't figure out how to do that with the universal forwarder.

[Steve_G_ · Accepted solution]

You can’t do that. The universal forwarder is its own separate executable. Unlike the light and heavy forwarders, you do not enable the universal forwarder from a full Splunk instance. Instead, you just download and install it.

Here’s where you download it:

http://www.splunk.com/download/universalforwarder

Now, just install it, as described here:

http://www.splunk.com/base/Documentation/latest/Deploy/Deploymentoverview

That’s it. No forwarder app to enable.