Getting Data In

UF in Linux how to configure


Dear Friends.

But I have some doughs I installed the UF in Centos and followed this cmd.
1: /Command: /opt/splunkforwarder/bin/splunk enable boot-start [successful]
2 😕 Now Configure Forwarder connection to Index Server

Command: /opt/splunkforwarder/bin/splunk add forward-server host. domain:9997 [SUCCESSFUL]

I have installed the UF in the below mention Path. Plz let me know if the path is correct.

[root@localhost] # cd/opt/splunkforwarder/
[root@localhost splunkforwarder] # ls -l
--r--r--r-- 1 splunk splunk 7555 nov 18 time splunkforwarder-6.5.1 [installed]

And i cannot access the Below Path to configure the Outputs.conf.

/opt/splunkforwarder/etc/system/local/outputs.conf –

I can only go till /opt/splunkforwarder/etc/ Under /etc/ I cannot find the /system/local/outputs.conf/

I request you to please help me on this.

Waiting for your reply.

Tags (1)
0 Karma


Hi fazilhussain,

that path is correct. Splunk's installation ships with default settings which are found under $SPLUNK_HOME/etc/system/default/.
Do not make changes there. Copy the outputs.conf from the default folder to the local folder and make your configurations there.

Edit: Addtitional info - The default configs are only used for deploying apps. Configs in etc/system/local will overwride the standard/default settings.


0 Karma
Get Updates on the Splunk Community!

Splunk Lantern | Getting Started with Edge Processor, Machine Learning Toolkit ...

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data ...

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...

Announcing the 1st Round Champion’s Tribute Winners of the Great Resilience Quest

We are happy to announce the 20 lucky questers who are selected to be the first round of Champion's Tribute ...