Getting Data In

How to configure universal forwarders on Windows servers to forward logs to a certain index on a Linux server?

ginger8990
Explorer

We have a Linux-based Splunk enterprise server (free version)
I installed the universal forwarder on a few windows servers. We created a new index called test_index, but I have some difficulty to forward all logs to the certain index.

Need some advice and help.

0 Karma
1 Solution

jayannah
Builder

Read on how to configure UF to send data to indexer at http://docs.splunk.com/Documentation/Splunk/6.2.1/Forwarding/Setupforwardingandreceiving

You need to create index on indexer and not on UF (uni. forwarder).

Steps.
1. Configure the receiving port on Indexer (inputs.conf for receiving data on port say 9997)
read details at http://docs.splunk.com/Documentation/Splunk/6.2.1/Forwarding/Enableareceiver
2. Configure Uni. Forwarders to send the logs to Indexer (outputs.conf). many examples at end of http://docs.splunk.com/Documentation/Splunk/6.2.1/Admin/Outputsconf
3. Configure the monitoring inputs on Uni. Forwarder (inputs.conf for monitoring the file). Many examples at end of http://docs.splunk.com/Documentation/Splunk/6.2.1/Admin/Inputsconf
Some information on how to get the data into Splunk, please read on
http://docs.splunk.com/Documentation/Splunk/6.2.0/Data/MonitorfilesanddirectoriesusingtheCLI

View solution in original post

jayannah
Builder

Read on how to configure UF to send data to indexer at http://docs.splunk.com/Documentation/Splunk/6.2.1/Forwarding/Setupforwardingandreceiving

You need to create index on indexer and not on UF (uni. forwarder).

Steps.
1. Configure the receiving port on Indexer (inputs.conf for receiving data on port say 9997)
read details at http://docs.splunk.com/Documentation/Splunk/6.2.1/Forwarding/Enableareceiver
2. Configure Uni. Forwarders to send the logs to Indexer (outputs.conf). many examples at end of http://docs.splunk.com/Documentation/Splunk/6.2.1/Admin/Outputsconf
3. Configure the monitoring inputs on Uni. Forwarder (inputs.conf for monitoring the file). Many examples at end of http://docs.splunk.com/Documentation/Splunk/6.2.1/Admin/Inputsconf
Some information on how to get the data into Splunk, please read on
http://docs.splunk.com/Documentation/Splunk/6.2.0/Data/MonitorfilesanddirectoriesusingtheCLI

ginger8990
Explorer

no permission to post comments

0 Karma

ginger8990
Explorer

somehow it didn't work after configured all these settings.
1) I could not see Apps and add client under forwarder management GUI
2) I only want to forward special folder files not event log. Does it forward event logs by default from windows?

0 Karma

piebob
Splunk Employee
Splunk Employee

please stop posting your follow-on comments as new answers.

0 Karma

ginger8990
Explorer

Greatly appreciate your information 🙂

0 Karma

piebob
Splunk Employee
Splunk Employee

ginger, please use the comment field instead of the Answer field when making a comment, and also please 'accept' the answer if it solves your problem. i've done it for you this time. thanks!

Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...