Splunk Enterprise

Universal forwarder - configuration

verifi81
Path Finder

Hello,

On a Universal Forwarder can someone tell me where the config is that tells the universal forwarder where to send the logs?

I need this for Windows and Linux.

Thank you

Labels (1)
0 Karma
1 Solution

verifi81
Path Finder

I found it. 

It's under $SPLUNK_HOME/etc/apps/search/local/

The file is outputs.conf

 

View solution in original post

0 Karma

vikramyadav
Contributor

I'm not sure which log file you are interested in so you can use btool to check outputs.conf

For Linux and Linux

$Splunk_Home/splunk btool outputs list --debug

 

-------------------------------------

If this help your like will be appreciated 🙂

 

0 Karma

verifi81
Path Finder

appreciate the quick response, but that video and blog did not tell me which file to view those settings at. My universal forwarders are already forwarding to an index and I'm simply trying to find which file I can CAT to view the indexer.  

0 Karma

vikramyadav
Contributor
0 Karma

verifi81
Path Finder

I found it. 

It's under $SPLUNK_HOME/etc/apps/search/local/

The file is outputs.conf

 

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...