Getting Data In

In what path/directory do you find forwarded data from a universal forwarder on the Splunk indexer?

05500
New Member

When we use universal forwarder, do you know where forwarded data is on the Splunk server?
Could you please tell me which path/directory for forwarded data?

0 Karma
1 Solution

kml_uvce
Builder

When you use universal forwarder then it reads data from files, script etc in inputs.conf file http://docs.splunk.com/Documentation/Splunk/6.2.2/Admin/inputsconf
and it sends data to indexer given in outputs.conf file
http://docs.splunk.com/Documentation/Splunk/6.2.2/Admin/Outputsconf

data in indexer is stored in indexes in location $SPLUNK_HOME/var/lib/splunk in indexer
http://docs.splunk.com/Documentation/Splunk/6.2.2/Admin/Splunk-launchconf

View solution in original post

kml_uvce
Builder

When you use universal forwarder then it reads data from files, script etc in inputs.conf file http://docs.splunk.com/Documentation/Splunk/6.2.2/Admin/inputsconf
and it sends data to indexer given in outputs.conf file
http://docs.splunk.com/Documentation/Splunk/6.2.2/Admin/Outputsconf

data in indexer is stored in indexes in location $SPLUNK_HOME/var/lib/splunk in indexer
http://docs.splunk.com/Documentation/Splunk/6.2.2/Admin/Splunk-launchconf

*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>