Universal forwarder not for forwarding

[saotaigiri]

After installing the universal forwarder on the forwarding host using windows, the splunk enterprise has been able to detect it but it is not sending any logs. Has 0 deployed apps. Please I need help on how to get it to start forwarding logs. Thanks.

[richgalloway]

Does the forwarder have inputs defined and enabled?  Has the forwarder written any error messages into its splunkd.log file?

[saotaigiri · Accepted solution]

Does the forwarder have inputs defined and enabled?  Has the forwarder written any error messages into its splunkd.log file?

Please I'm not too sure what you are asking, I installed the forwarder the normal way via windows, put in the splunk id and PW, put in a deployment server IP with the normal port 8089, the indexer @ 9997 and finished the installation. Not sure what I did wrong. Please help I'm a novice.

[richgalloway]

Do you have a deployment server configured in your Splunk environment?  If not, then the forwarder will not have any configurations and so will not know what to monitor.

The fix is to re-install the forwarder and skip the part about the deployment server.  The installer will then ask you what inputs you want to enable.