- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello,
I need help installing the Universal Fowarder for OS X as well as configuring it. Is there a guide online that goes over this or can someone give me a step by step procedure please. I looked at the http://docs.splunk.com/Documentation/SplunkLight/latest/Installation but that doesn't seem to help at all.
Thanks
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

Hi @cpreasbeck
Is this the documentation you're looking for?
http://docs.splunk.com/Documentation/Splunk/6.2.2/Forwarding/Deployanixdfmanually#Install_the_univer...
http://docs.splunk.com/Documentation/Splunk/6.2.2/Installation/InstallonMacOS
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

Hi @cpreasbeck
Is this the documentation you're looking for?
http://docs.splunk.com/Documentation/Splunk/6.2.2/Forwarding/Deployanixdfmanually#Install_the_univer...
http://docs.splunk.com/Documentation/Splunk/6.2.2/Installation/InstallonMacOS
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

Since Splunk 6.x is not more available, the new URL's are:
Forwarder Manual:
https://docs.splunk.com/Documentation/Forwarder/9.1.2/Forwarder/Installanixuniversalforwarder..
Installation on MacOS:
https://docs.splunk.com/Documentation/Splunk/9.1.2/Installation/InstallonMacOS
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
When I download the universal forwarder it gives me a tar file. I unpack it and it provides me with a splunkforwarder folder and inside I don't see anything that pertains to installing it. This may be a dumb question but how do I get this installed? Is there another piece to the universal forwarder that needs to be installed first? Also once you get it installed how do I go about editing it so I can direct to grab logs from system.log and forward that out to the server?
Thanks much for the help!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

So I'm guessing you got as far as making sure the package name is /opt/splunkforwarder
instead of just opt/splunk
which is for a full instance as documented here:
http://docs.splunk.com/Documentation/Splunk/6.2.2/Forwarding/Deployanixdfmanually#The_package_name
Have you looked at the instructions following that section which covers starting and configuring the universal forwarder?
http://docs.splunk.com/Documentation/Splunk/6.2.2/Forwarding/Deployanixdfmanually#Configure_the_univ...
