Splunk Enterprise

Splunk Universal Forwarder - selection of types of data to be transmitted


Hi, All,

I r baboon.

I try to configure Universal Forwarder, but it seems that somewhere i'm doing wrong.

First of all, specifically, i want to know if somewhere in Splunk folder or UF, resides an config file where i can write what data to send, like syslog, security and all of that, what types of data i can get out of my machine.

This is the first point of interest.

Anything else of UF config i don't need right now, because where i work i'm working in a medium where don't have full control of IT infrastructure, like the ability to open ports and all that. I don't even have admin rights on my local machine :)))

Thank you.

Tags (1)
0 Karma


Hi All,

First of all, thank you for your fast response.

Second of all, i managed to solve the problem.

From what i have read in all of that documentation, i couldn't make it because when you setup your receiver, you need to specify in your >Local inputs< what type of data to get in >Local event log collection<.

I have selected ForwardedEvents and now i can get some data in.

Correct me if i'm wrong, but i guess this is the wrong solution xD :))

Also, i had to make indexes for what indexes i get from forwarder in receiver.

Thank you,

0 Karma



you should have a look at this


if you are working with forwarder, you are looking for inputs.conf. This is the file you have to configure to get your data sources set up. Then you need outputs.conf to send this data to your indexer.

0 Karma

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!