Join the Conversation
- Find Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- Re: How to configure universal forwarders on Windo...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
We have a Linux-based Splunk enterprise server (free version)
I installed the universal forwarder on a few windows servers. We created a new index called test_index, but I have some difficulty to forward all logs to the certain index.
Need some advice and help.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Read on how to configure UF to send data to indexer at http://docs.splunk.com/Documentation/Splunk/6.2.1/Forwarding/Setupforwardingandreceiving
You need to create index on indexer and not on UF (uni. forwarder).
Steps.
1. Configure the receiving port on Indexer (inputs.conf for receiving data on port say 9997)
read details at http://docs.splunk.com/Documentation/Splunk/6.2.1/Forwarding/Enableareceiver
2. Configure Uni. Forwarders to send the logs to Indexer (outputs.conf). many examples at end of http://docs.splunk.com/Documentation/Splunk/6.2.1/Admin/Outputsconf
3. Configure the monitoring inputs on Uni. Forwarder (inputs.conf for monitoring the file). Many examples at end of http://docs.splunk.com/Documentation/Splunk/6.2.1/Admin/Inputsconf
Some information on how to get the data into Splunk, please read on
http://docs.splunk.com/Documentation/Splunk/6.2.0/Data/MonitorfilesanddirectoriesusingtheCLI
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Read on how to configure UF to send data to indexer at http://docs.splunk.com/Documentation/Splunk/6.2.1/Forwarding/Setupforwardingandreceiving
You need to create index on indexer and not on UF (uni. forwarder).
Steps.
1. Configure the receiving port on Indexer (inputs.conf for receiving data on port say 9997)
read details at http://docs.splunk.com/Documentation/Splunk/6.2.1/Forwarding/Enableareceiver
2. Configure Uni. Forwarders to send the logs to Indexer (outputs.conf). many examples at end of http://docs.splunk.com/Documentation/Splunk/6.2.1/Admin/Outputsconf
3. Configure the monitoring inputs on Uni. Forwarder (inputs.conf for monitoring the file). Many examples at end of http://docs.splunk.com/Documentation/Splunk/6.2.1/Admin/Inputsconf
Some information on how to get the data into Splunk, please read on
http://docs.splunk.com/Documentation/Splunk/6.2.0/Data/MonitorfilesanddirectoriesusingtheCLI
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
no permission to post comments
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
somehow it didn't work after configured all these settings.
1) I could not see Apps and add client under forwarder management GUI
2) I only want to forward special folder files not event log. Does it forward event logs by default from windows?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
please stop posting your follow-on comments as new answers.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Greatly appreciate your information 🙂
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
ginger, please use the comment field instead of the Answer field when making a comment, and also please 'accept' the answer if it solves your problem. i've done it for you this time. thanks!
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Cisco Data Fabric from Architecture to Investigation, Better SOC Visibility, and More ...
The Trust Gap: Why a Data Foundation is Fundamental to an Agentic Enterprise
Data Management Digest – September 2026
