Join the Conversation
- Find Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- Re: Splunk Universal Forwarder on Win 2000?
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hallo,
we know it´s not supported officially, but we have some very old Windows 2000 server, that won´t be upgraded before next year, but we need to install Splunk on them. Will the Universal Forwarder work on Windows 2000?
Thank you!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I think there may be a difference between the forwarder and the configuration I have, but I have yet to figure out what it is, so here's what I know...
I installed Splunk 4.2.1 (Enterprise trial, but since then the trial ran out, so I am running the free license now). Go to Manager > Forwarding and receiving > Forwarding defaults, chose not to store local copy of the events (otherwise I guess this would be an indexer as well). Then go to Configure forwarding and add the host you want to send data to.
good luck...
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I've tested upto 5.0 works..
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Yep 4.2.1 works on Win 2000.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
fcorbin, thank you, i guess than Splunk> does not try to force you to install on only supported plattforms like other products (BMC....) do...
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I think there may be a difference between the forwarder and the configuration I have, but I have yet to figure out what it is, so here's what I know...
I installed Splunk 4.2.1 (Enterprise trial, but since then the trial ran out, so I am running the free license now). Go to Manager > Forwarding and receiving > Forwarding defaults, chose not to store local copy of the events (otherwise I guess this would be an indexer as well). Then go to Configure forwarding and add the host you want to send data to.
good luck...
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello, thank you. Did you install the Splunk Forwarder 4.2.1?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I am new to Splunk so there may be things I haven't seen. FWIW, I installed Splunk as an indexer on a Win 2000 server and it worked fine. I later converted that machine to be a forwarder and it still works fine.
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Deep Dive: Accelerate threat investigation with Splunk’s AI Assistant in Security
Announcing Modern Navigation: A New Era of Splunk User Experience
Detection Engineering Office Hours: Real-World Troubleshooting & Q&A
