I have a universal forwarder installed on Mac OS X and am unable to configure data input to use a script. The script is in place in the directory with the proper permissions, but the data input wizard states that "No Scripts found under the selected path.".
Hi! There are basically two ways to configure a Universal Forwarder: Either 1) by using the CLI or configuration files directly on the Universal Forwarder or by 2) using a deployment server.
I suppose you want to use a deployment server. In this case, the deployment server will distribute the configuration (including scripts) to the Universal Forwarder. When creating a new Forwarded Script Input via the deployment server's web GUI then you need to place the script on your deployment server (not on your Universal Forwarder as seen in your screenshot) in $SPLUNK_HOME/bin/scripts. The script will then get transferred to the Universal Forwarder as part of the Server Class.
Hello! Thanks for the reply. This really clears some things up. What if you are running Splunk Light in the cloud. If the instance is in the cloud how does one access it to create/modify/upload different deployment items?