windows - universal forwarder - localhost

[gmoors]

I'm trying to let Splunk Enterprise log some creation of a user on the same system as where Splunk is installed.

My Splunk-version is 9.3.1. Alongside with this install, I've installed the latest Universal Forwarder (win) (on localhost 127.0.0.1).
When installing:
- I skip the SSL page
- click "Next"
- select "Local System"
- click "Next"
- check all items under "Windows Log Events"
- click "Next"
- generate an admin account and password
- leave the "Deployment Server"-settings empty
- enter "127.0.0.1:9997" as Host and port for "Receiving Indexer"
- finish the installer

Then I create a user (net user /add <user>) in CMD.
After this step I return to Splunk Search and enter * as search criteria but nothing is found. Even when I enter the username (I added) the software finds nothing.

Can someone tell me what I'm doing wrong or what the issue can be?
Thanks!

Gerd

[PickleRick · Accepted solution]

Universal Forwarder is a lighweight component you typically install on remote machines to - as the name suggests - forward the data to your "main part" of Splunk installation. But if you already have full Splunk instance installed you don't need a UF (there are some border cases when such setup can be useful but makes the whole environment overly complicated).

So if you're just starting with Splunk, it's enough to add local windows event log inputs on the Splunk server.

[gmoors]

Thanks for the clear info!

[PickleRick]

First and foremost - why are you installing a UF when you already have a full Splunk instance? Just add input(s) there.

[gmoors]

Ooh - that isn't necessary?
Sorry, I'm new to Splunk.

I was watching some tutorial on Udemy regarding Splunk and was following the guy who did the demo.
After installing Splunk Enterprise, he started talking about the "universal forwarder" and how to install it. I thought it was part of the whole...

So it wasn't required?

[gmoors]

Never mind...

I've stopped the universal forwarder-software, waited some second and restarted the forwarder.
After this restart I performed a search (*)  and it immediately gave me some results.

I then created a user in the PowerShell, and let Splunk search for the username, resulting in some lines regarding the user.

So... eventually it works as it should...

With kind regards
Gerd