How to configure universal forwarders on Windows servers to forward logs to a certain index on a Linux server?

[ginger8990]

We have a Linux-based Splunk enterprise server (free version)
I installed the universal forwarder on a few windows servers. We created a new index called test_index, but I have some difficulty to forward all logs to the certain index.

Need some advice and help.

[jayannah · Accepted solution]

Read on how to configure UF to send data to indexer at http://docs.splunk.com/Documentation/Splunk/6.2.1/Forwarding/Setupforwardingandreceiving

You need to create index on indexer and not on UF (uni. forwarder).

Steps.
1. Configure the receiving port on Indexer (inputs.conf for receiving data on port say 9997)
read details at http://docs.splunk.com/Documentation/Splunk/6.2.1/Forwarding/Enableareceiver
2. Configure Uni. Forwarders to send the logs to Indexer (outputs.conf). many examples at end of http://docs.splunk.com/Documentation/Splunk/6.2.1/Admin/Outputsconf
3. Configure the monitoring inputs on Uni. Forwarder (inputs.conf for monitoring the file). Many examples at end of http://docs.splunk.com/Documentation/Splunk/6.2.1/Admin/Inputsconf
Some information on how to get the data into Splunk, please read on
http://docs.splunk.com/Documentation/Splunk/6.2.0/Data/MonitorfilesanddirectoriesusingtheCLI

[ginger8990]

no permission to post comments

[ginger8990]

somehow it didn't work after configured all these settings.
1) I could not see Apps and add client under forwarder management GUI
2) I only want to forward special folder files not event log. Does it forward event logs by default from windows?

[piebob]

please stop posting your follow-on comments as new answers.

[ginger8990]

Greatly appreciate your information 🙂

[piebob]

ginger, please use the comment field instead of the Answer field when making a comment, and also please 'accept' the answer if it solves your problem. i've done it for you this time. thanks!