Getting Data In

Why can't I see any Windows data forwarded from a Win7 machine with a universal forwarder installed and monitoring configured?

alessandromagri
New Member

Hi everybody,
I need to set up a system monitor that collects logon and logout data from some Windows machines (server 2003, server 2008 and Win7).
I've installed the server on an ubuntu server and the Universal Forwarder on the Win7 pc. After the installation of that client I've added the Win7 to the AddData-->forward (in both machine it's set to collect all types of logs) but I can't see any logs about the Win7 machine. Or perhaps I don't know how to see it?

Can anyone help me?

Thanks!

0 Karma

dxmiller
Explorer

I would check your Windows Firewall or 3rd party Firewall/HIPS software to ensure that the Universal Forwarder is permitted to send the log traffic to your Splunk server via TCP 8089. If everything is in order there, I would then check your inputs.conf and outputs.conf files to make sure everything is in order.

0 Karma

alessandromagri
New Member

Now I'm trying to check the inputs.conf and output.conf file but I dont know where to find the right files: in the SplunkUniversalForwarder folder there are many inputs.conf so i dont know the right one to check.
Can someone explane me how I've to do?

0 Karma

alessandromagri
New Member

Thanks for the quick reply.
I've permitt all ports and all protocols for Universal Forwarder on my firewall, but I don't see any log.

But exactly what I've to search to find Windows log?

0 Karma
Get Updates on the Splunk Community!

Earn a $35 Gift Card for Answering our Splunk Admins & App Developer Survey

Survey for Splunk Admins and App Developers is open now! | Earn a $35 gift card!      Hello there,  Splunk ...

Continuing Innovation & New Integrations Unlock Full Stack Observability For Your ...

You’ve probably heard the latest about AppDynamics joining the Splunk Observability portfolio, deepening our ...

Monitoring Amazon Elastic Kubernetes Service (EKS)

As we’ve seen, integrating Kubernetes environments with Splunk Observability Cloud is a quick and easy way to ...