Unviersal Forwarder without an app

[htkhtk]

Basically I want to be able to send JBoss server logs from one linux machine to another using the Splunk Universal Forwarder.

What do i need to configure?

1. I installed the splunk universal forwarder on the linux machine with JBoss.
2. I set up the receiving machine to listen on port 9997.

I also want the logs to go to a particular index.

Do I set up the monitor? Which side do monitors get set up? Which side does inputs.conf need updated?

[jbsplunk · Accepted solution]

You'd need to set up a monitor stanza inside of your inputs.conf on the Universal forwarder where the files that you'd like to monitor exist. You would specify the index in inputs.conf on your universal forwarder. This will route the data into the index, presuming it exists, on the Indexer/Receiver you've configured.