Universal Forwarder-> Heavy Forwarder -> Indexer
We have a universal forwarder which is sitting on a different domain from where we want to collect data using a shell script.
Using the UI, I uploaded the shell script on the universal forwarder. How do I configure what data to send to the indexer?
As I have uploaded the shell using UI on the universal forwarder, do I need to configure the inputs.conf again?
What would be the settings/parameters on both the inputs.conf on the UF and HF
and also the outputs.conf?
You have to configure inputs.conf,
[script://<script>]
interval=60
60 seconds is the default value for interval, and you can use the usual attributes like index, sourcetype, disabled.
see http://docs.splunk.com/Documentation/Splunk/6.2.5/Data/Setupcustominputs