Getting Data In

How to configure universal forwarders on Windows servers to forward logs to a certain index on a Linux server?

ginger8990
Explorer

We have a Linux-based Splunk enterprise server (free version)
I installed the universal forwarder on a few windows servers. We created a new index called test_index, but I have some difficulty to forward all logs to the certain index.

Need some advice and help.

0 Karma
1 Solution

jayannah
Builder

Read on how to configure UF to send data to indexer at http://docs.splunk.com/Documentation/Splunk/6.2.1/Forwarding/Setupforwardingandreceiving

You need to create index on indexer and not on UF (uni. forwarder).

Steps.
1. Configure the receiving port on Indexer (inputs.conf for receiving data on port say 9997)
read details at http://docs.splunk.com/Documentation/Splunk/6.2.1/Forwarding/Enableareceiver
2. Configure Uni. Forwarders to send the logs to Indexer (outputs.conf). many examples at end of http://docs.splunk.com/Documentation/Splunk/6.2.1/Admin/Outputsconf
3. Configure the monitoring inputs on Uni. Forwarder (inputs.conf for monitoring the file). Many examples at end of http://docs.splunk.com/Documentation/Splunk/6.2.1/Admin/Inputsconf
Some information on how to get the data into Splunk, please read on
http://docs.splunk.com/Documentation/Splunk/6.2.0/Data/MonitorfilesanddirectoriesusingtheCLI

View solution in original post

jayannah
Builder

Read on how to configure UF to send data to indexer at http://docs.splunk.com/Documentation/Splunk/6.2.1/Forwarding/Setupforwardingandreceiving

You need to create index on indexer and not on UF (uni. forwarder).

Steps.
1. Configure the receiving port on Indexer (inputs.conf for receiving data on port say 9997)
read details at http://docs.splunk.com/Documentation/Splunk/6.2.1/Forwarding/Enableareceiver
2. Configure Uni. Forwarders to send the logs to Indexer (outputs.conf). many examples at end of http://docs.splunk.com/Documentation/Splunk/6.2.1/Admin/Outputsconf
3. Configure the monitoring inputs on Uni. Forwarder (inputs.conf for monitoring the file). Many examples at end of http://docs.splunk.com/Documentation/Splunk/6.2.1/Admin/Inputsconf
Some information on how to get the data into Splunk, please read on
http://docs.splunk.com/Documentation/Splunk/6.2.0/Data/MonitorfilesanddirectoriesusingtheCLI

ginger8990
Explorer

no permission to post comments

0 Karma

ginger8990
Explorer

somehow it didn't work after configured all these settings.
1) I could not see Apps and add client under forwarder management GUI
2) I only want to forward special folder files not event log. Does it forward event logs by default from windows?

0 Karma

piebob
Splunk Employee
Splunk Employee

please stop posting your follow-on comments as new answers.

0 Karma

ginger8990
Explorer

Greatly appreciate your information 🙂

0 Karma

piebob
Splunk Employee
Splunk Employee

ginger, please use the comment field instead of the Answer field when making a comment, and also please 'accept' the answer if it solves your problem. i've done it for you this time. thanks!

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...