Getting Data In

pushing data to Universal forwarder from .Net

raghu_vaidya
Explorer

Hello,
I want to push the data to Universal forwarder, so that forwarder can forward the data to the Indexer.
I have Splunk installed on Server_1 and on Server_2 I have universal forwarder installed.
I am executing my .net code from Server_2 which posts a simple text message to forwarder and forwarder needs to push this data to Server_1. How can this be done? what all changes needs to be done to the .conf files?

I have already added Receiver on Server_1 and able to get Windows Event log data from Server_2 - this proves that the forwarder is actually forwarding the data to Server_1

I am able to create a new tcp port using Data Inputs->Tcp option on Server_1 and from Server_2 using my .net code I am able to post the data, but now, instead of posting it directly to Server_1 I want to post it to universal forwarder on Server_2 so that universal forwarder takes care of forwarding the data.
Hope, I am clear with my requirement 🙂

Thanks!!

0 Karma
1 Solution

raghu_vaidya
Explorer

I was able to find the answer for my question:
We need to add the following stanza in inputs.conf on the system where Universal Forwarder is installed.

[tcp://33333]
sourcetype=log4net
disabled=false

On a windows based system inputs.conf can be found at the below location
$SPLUNK_HOME/etc/apps/MSICreated/local/

View solution in original post

0 Karma

raghu_vaidya
Explorer

I was able to find the answer for my question:
We need to add the following stanza in inputs.conf on the system where Universal Forwarder is installed.

[tcp://33333]
sourcetype=log4net
disabled=false

On a windows based system inputs.conf can be found at the below location
$SPLUNK_HOME/etc/apps/MSICreated/local/

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Character substitutions with Regular Expressions

This challenge was first posted on Slack #puzzles channelFor BORE at .conf23, we had a puzzle question which ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

[Puzzles] Solve, Learn, Repeat: Matching cron expressions

This puzzle (first published here) is based on matching timestamps to cron expressions.All the timestamps ...