Universal Forwarded on Windows doesn't send data to indexer

[dobi]

I'm brand new to this and am hopeful this has a ready-made answer I've not been able to find (yet) but:

We installed the universal forwarder from our Splunk Cloud instructions:

Set up the .spl file and added a monitor to a log4j folder of a software that server runs. 

How we set this up on our non-Windows systems is with indexer tokens that are used at setup. 

In my case with this windows system, the installation and set up goes fine. I don't see any errors in the splunkd.log on the host machine. But there's no data for that index. 

How do I add the specific index token to the universal forwarder?

[richgalloway · Accepted solution]

WTH is an "index(er) token"?

Forwarders are configured exactly the same way in Windows as in Linux (except for file paths) - create apps  in the Deployment Server and add that app to the appropriate server class so the UFs download it.  You'll probably want at least three apps - the Universal Forwarder app as downloaded from Splunk Cloud, plus one for Linux inputs, and one for Windows inputs.  There should be no mucking about with the UF itself.

The monitor stanza goes in the app's inputs.conf file.  It will look something like this.

[monitor:///some/path/to/log4j/file.log]
sourcetype = mysourcetype
index = myindex

[monitor://C:\Some\Path\to\log4j\file.log]
sourcetype = mysourcetype
index = myindex

[dobi]

That! 

I think our other systems were set up a bit differently. Adding the index to the inputs.conf was what I was looking for!

Many thanks!