Splunk Universal Forwarder for Windows 9.0.4

Splunk Cloud Platform

Hi,

I have installed Splunk Universal Forwarder for windows 9.0.4 to work with Splunk Cloud. Downloaded credential packages and saw logs in Splunk cloud. We need to send these logs to a index other than the main. Do you know how I can do this? Also, which files would need to be edited if we want to add/remove log source (right now, we only have windows security logs, but maybe we want to add windows application logs also) Can the installation of UF and these files be done via Microsoft SCCM when we need to do a mass deployment (instead of using deployment server)?

Thanks,

Krunal Dave

Get Updates on the Splunk Community!

Splunk Universal Forwarder for Windows 9.0.4

using Splunk Cloud

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas

What Is the Name of the USB Key Inserted by Bob Smith? (BOTS Hint, Not the Answer)

Automating Threat Operations and Threat Hunting with Recorded Future

Join the Conversation

Splunk Universal Forwarder for Windows 9.0.4

using Splunk Cloud

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas

What Is the Name of the USB Key Inserted by Bob Smith? (BOTS Hint, Not the Answer)

Automating Threat Operations and Threat Hunting with Recorded Future