Are you a member of the Splunk Community?
- Find Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- windows - universal forwarder - localhost
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I'm trying to let Splunk Enterprise log some creation of a user on the same system as where Splunk is installed.
My Splunk-version is 9.3.1. Alongside with this install, I've installed the latest Universal Forwarder (win) (on localhost 127.0.0.1).
When installing:
- I skip the SSL page
- click "Next"
- select "Local System"
- click "Next"
- check all items under "Windows Log Events"
- click "Next"
- generate an admin account and password
- leave the "Deployment Server"-settings empty
- enter "127.0.0.1:9997" as Host and port for "Receiving Indexer"
- finish the installer
Then I create a user (net user /add <user>) in CMD.
After this step I return to Splunk Search and enter * as search criteria but nothing is found. Even when I enter the username (I added) the software finds nothing.
Can someone tell me what I'm doing wrong or what the issue can be?
Thanks!
Gerd
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Universal Forwarder is a lighweight component you typically install on remote machines to - as the name suggests - forward the data to your "main part" of Splunk installation. But if you already have full Splunk instance installed you don't need a UF (there are some border cases when such setup can be useful but makes the whole environment overly complicated).
So if you're just starting with Splunk, it's enough to add local windows event log inputs on the Splunk server.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Universal Forwarder is a lighweight component you typically install on remote machines to - as the name suggests - forward the data to your "main part" of Splunk installation. But if you already have full Splunk instance installed you don't need a UF (there are some border cases when such setup can be useful but makes the whole environment overly complicated).
So if you're just starting with Splunk, it's enough to add local windows event log inputs on the Splunk server.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thanks for the clear info!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
First and foremost - why are you installing a UF when you already have a full Splunk instance? Just add input(s) there.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Ooh - that isn't necessary?
Sorry, I'm new to Splunk.
I was watching some tutorial on Udemy regarding Splunk and was following the guy who did the demo.
After installing Splunk Enterprise, he started talking about the "universal forwarder" and how to install it. I thought it was part of the whole...
So it wasn't required?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Never mind...
I've stopped the universal forwarder-software, waited some second and restarted the forwarder.
After this restart I performed a search (*) and it immediately gave me some results.
I then created a user in the PowerShell, and let Splunk search for the username, resulting in some lines regarding the user.
So... eventually it works as it should...
With kind regards
Gerd
What Is Splunk? Here’s What You Can Do with Splunk
Level Up Your .conf25: Splunk Arcade Comes to Boston
Manual Instrumentation with Splunk Observability Cloud: How to Instrument Frontend ...
