Getting Data In

pushing data to Universal forwarder from .Net

raghu_vaidya
Explorer

Hello,
I want to push the data to Universal forwarder, so that forwarder can forward the data to the Indexer.
I have Splunk installed on Server_1 and on Server_2 I have universal forwarder installed.
I am executing my .net code from Server_2 which posts a simple text message to forwarder and forwarder needs to push this data to Server_1. How can this be done? what all changes needs to be done to the .conf files?

I have already added Receiver on Server_1 and able to get Windows Event log data from Server_2 - this proves that the forwarder is actually forwarding the data to Server_1

I am able to create a new tcp port using Data Inputs->Tcp option on Server_1 and from Server_2 using my .net code I am able to post the data, but now, instead of posting it directly to Server_1 I want to post it to universal forwarder on Server_2 so that universal forwarder takes care of forwarding the data.
Hope, I am clear with my requirement 🙂

Thanks!!

0 Karma
1 Solution

raghu_vaidya
Explorer

I was able to find the answer for my question:
We need to add the following stanza in inputs.conf on the system where Universal Forwarder is installed.

[tcp://33333]
sourcetype=log4net
disabled=false

On a windows based system inputs.conf can be found at the below location
$SPLUNK_HOME/etc/apps/MSICreated/local/

View solution in original post

0 Karma

raghu_vaidya
Explorer

I was able to find the answer for my question:
We need to add the following stanza in inputs.conf on the system where Universal Forwarder is installed.

[tcp://33333]
sourcetype=log4net
disabled=false

On a windows based system inputs.conf can be found at the below location
$SPLUNK_HOME/etc/apps/MSICreated/local/

0 Karma
Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...