Splunk Enterprise

Universal forwarder - configuration

Path Finder

Hello,

On a Universal Forwarder can someone tell me where the config is that tells the universal forwarder where to send the logs?

I need this for Windows and Linux.

Thank you

Labels (1)
0 Karma
1 Solution

Path Finder

I found it. 

It's under $SPLUNK_HOME/etc/apps/search/local/

The file is outputs.conf

 

View solution in original post

0 Karma

Contributor

I'm not sure which log file you are interested in so you can use btool to check outputs.conf

For Linux and Linux

$Splunk_Home/splunk btool outputs list --debug

 

-------------------------------------

If this help your like will be appreciated 🙂

 

0 Karma

Path Finder

appreciate the quick response, but that video and blog did not tell me which file to view those settings at. My universal forwarders are already forwarding to an index and I'm simply trying to find which file I can CAT to view the indexer.  

0 Karma

Contributor
0 Karma

Path Finder

I found it. 

It's under $SPLUNK_HOME/etc/apps/search/local/

The file is outputs.conf

 

View solution in original post

0 Karma