Getting Data In

Where do I find the logs of a universal forwarder that are installed in a domain controller?

pramach
New Member

Where do I find the logs of a universal forwarder that are installed in a domain controller?

We have universal forwarder installed in domain controller bu the logs for password change attempts are seen in the Domain controller but not in Splunk search head.
Please help to check if the universal forwarder has pushed the logs for password change attempt to the indexer/ heavy forwarder.

0 Karma

aaraneta_splunk
Splunk Employee
Splunk Employee

@pramach - Did the answer provided by woodcock help provide a working solution to your question? If yes, please don't forget to resolve this post by clicking "Accept". If no, please leave a comment with more feedback. Thanks!

0 Karma

woodcock
Esteemed Legend

I assume that you are using the TAs, which is great, but there is still admin to do. The most common mistake is that you have not created the index that is used in the inputs.conf. Any index that is used must be created in indexes.conf AND on your filesystem on each of your indexers. Your error logs will be flooded with logs complaining about this, if this is your problem.

0 Karma

somesoni2
Revered Legend

Have you configured your universal forwarders (assuming it's on windows) to monitor (and send ) the event logs ?

0 Karma

pramach
New Member

Yes..We have configures

0 Karma
Get Updates on the Splunk Community!

Introducing Splunk Enterprise 9.2

WATCH HERE! Watch this Tech Talk to learn about the latest features and enhancements shipped in the new Splunk ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...