Getting Data In

Why am I unable to get data from the forwarder to the Splunk application?

New Member

Hi Team,

I have installed the 6.4.3 version of the universal forwarder on a Windows server 2012. But i am unable to get the server data from the forwarder to the Spunk application.

Below are the details of the data present in the three configuration files.


host = gmwcnappv00150

disabled = 0

I need the data from the forwarder server gmwcnappv00586 to be reflected in the splunk application server gmwcnappv00150
Kindly let me know the comment as earliest

Sanket Panchal

0 Karma



you're missing an inputs.conf stanza for a Universal Forwarder sending to your indexer.
Something like this:

 compressed = true
 disabled = 0
 connection_host = none

You could also write:


if gmwcnappv00150 is your UF.

Did that help?


Edit: typo

0 Karma
Get Updates on the Splunk Community!

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...