I have installed 1 forwarder on my linux machine-1 and another on windows apache machine-2. The splunk has been installed on another windows machine-3. i was able to enable the receiving and am able to view forwader in splunk.
Now i need to monitor my apache logs from machine-1 and application logs from machine-2 from the remote machine-3 where splunk is installed. I have read the documentations, but it didnt helped me much.
What entry need to be made in outputs.conf on forwader and inputs.conf on splunk for this requirement.
This is a general guideline of where the different conf files should live. If you need more details I suggest you re-read the documentation with this guideline in mind. Good luck.
inputs.conf needs to be defined on both the forwarders and the indexers.
outputs.conf needs to be defined on the forwarders
props.conf needs to be defined on the indexer
indexes.conf needs to be defined on the indexer