How do you install and configure a Splunk Universal Forwarder on OS X?

[cpreasbeck]

Hello,

I need help installing the Universal Fowarder for OS X as well as configuring it. Is there a guide online that goes over this or can someone give me a step by step procedure please. I looked at the http://docs.splunk.com/Documentation/SplunkLight/latest/Installation but that doesn't seem to help at all.

Thanks

[ppablo · Accepted solution]

Hi @cpreasbeck

Is this the documentation you're looking for?
http://docs.splunk.com/Documentation/Splunk/6.2.2/Forwarding/Deployanixdfmanually#Install_the_univer...
http://docs.splunk.com/Documentation/Splunk/6.2.2/Installation/InstallonMacOS

[patrickvanreck]

Since Splunk 6.x is not more available, the new URL's are:

Forwarder Manual:
https://docs.splunk.com/Documentation/Forwarder/9.1.2/Forwarder/Installanixuniversalforwarder.. 

Installation on MacOS:
https://docs.splunk.com/Documentation/Splunk/9.1.2/Installation/InstallonMacOS 

[isoutamo]

You should replace the version number with word “latest” and then you will get the latest version of those documents.

[cpreasbeck]

When I download the universal forwarder it gives me a tar file. I unpack it and it provides me with a splunkforwarder folder and inside I don't see anything that pertains to installing it. This may be a dumb question but how do I get this installed? Is there another piece to the universal forwarder that needs to be installed first? Also once you get it installed how do I go about editing it so I can direct to grab logs from system.log and forward that out to the server?

Thanks much for the help!

[ppablo]

So I'm guessing you got as far as making sure the package name is /opt/splunkforwarder instead of just opt/splunk which is for a full instance as documented here:
http://docs.splunk.com/Documentation/Splunk/6.2.2/Forwarding/Deployanixdfmanually#The_package_name

Have you looked at the instructions following that section which covers starting and configuring the universal forwarder?
http://docs.splunk.com/Documentation/Splunk/6.2.2/Forwarding/Deployanixdfmanually#Configure_the_univ...