what is the difference in configuration between forwarders for receiving and sending

[windyita]

I have read another Q&A
http://answers.splunk.com/answers/50082/how-do-i-configure-a-splunk-forwarder-on-linux
but I'm confused whether the steps should be done on the receiver or the sender.
thanks in advance

[MuS · Accepted solution]

Hi windyita,

universal forwarder is the sender and indexer is the receiver, so

• Steps 1-3 are obviously done on the universal forwarder
• Step 4 is done on the indexer which is the receiver, if it has not been done before. This is a one time action.
• Steps 5-7 are done on the universal forwarder

hope this helps ...

cheers, MuS

[windyita]

I actually did as what you have said, but in step 7:
Step 7: Add Data:

/opt/splunkforwarder/bin/splunk add monitor /path/to/app/logs/ -index main -sourcetype %app%

This will create a file: inputs.conf in /opt/splunk/etc/apps/search/local/

Note: System logs in /var/log/ are covered in the configuration part of Step 7. If you have application logs in /var/log/*/

I didn't find inputs.conf in /opt/splunk/etc/apps/search/local/

What is the reason ? thx