splunk universal forwarder

[iherb_0718]

Hi,

My environment consists of a deployment server and Heavy  Forwarders.

The Windows Server clients have a Universal forwarder sending to the Heavy Forwarder. Can someone tell me where the configuration file is within the Windows server that tells it which heavy forwarder to send the data to?

[iherb_0718]

my mistake. i see it in the outputs.conf. thank you

[iherb_0718]

Hi Scelikok. I'm on a windows server and the install folder is in C:\Program Files\SplunkUniversalForwarder

I searched this folder for outputs.conf but when I open it, I don't see my heavy forwarder server.   I'm trying to find out which heavy forwarder this server is configured for. 

Assume I don't have access to the deployment server at this time.

[scelikok]

Hi @iherb_0718,

On Windows Universal Forwarder you should check for outputs.conf file. That should be being managed by an app on Deployment servers $SPLUNK_HOME/etc/deployment_apps folder.

On Windows Universal Forwarder you can run btool to find outputs.conf file path. Please run below command on #SPLUNK_HOME path of windows (default path is %PROGRAMFILES%\SplunkUniversalForwarder)

%PROGRAMFILES%\SplunkUniversalForwarder\bin\splunk btool outputs list --debug

From above command output you can see which outputs.conf to check on deployment server.

If this reply helps you an upvote is appreciated.