Splunk Universal Forwarder for Windows 9.0.4

Splunk Cloud Platform

Hi,

I have installed Splunk Universal Forwarder for windows 9.0.4 to work with Splunk Cloud. Downloaded credential packages and saw logs in Splunk cloud. We need to send these logs to a index other than the main. Do you know how I can do this? Also, which files would need to be edited if we want to add/remove log source (right now, we only have windows security logs, but maybe we want to add windows application logs also) Can the installation of UF and these files be done via Microsoft SCCM when we need to do a mass deployment (instead of using deployment server)?

Thanks,

Krunal Dave

Get Updates on the Splunk Community!

Splunk Universal Forwarder for Windows 9.0.4

using Splunk Cloud

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Announcing Modern Navigation: A New Era of Splunk User Experience

Modernize your Splunk Apps – Introducing Python 3.13 in Splunk

Step into “Hunt the Insider: An Splunk ES Premier Mystery” to catch a cybercriminal ...

Join the Conversation

Splunk Universal Forwarder for Windows 9.0.4

using Splunk Cloud

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Announcing Modern Navigation: A New Era of Splunk User Experience

Modernize your Splunk Apps – Introducing Python 3.13 in Splunk

Step into “Hunt the Insider: An Splunk ES Premier Mystery” to catch a cybercriminal ...