Here is some information about fields and field extraction -- you can review the sections in the left panel: http://docs.splunk.com/Documentation/Splunk/6.6.2/Knowledge/Aboutfields You can also review the Related Questions in the right panel of this Answers page. Not sure how to resolve your issue, but will contact someone that might be able to help. ... View more

See http://docs.splunk.com/Documentation/Splunk/6.6.2/Search/Usethesearchcommand#Keywords_and_phrases ... View more

Hi Nancy, The localhost is the machine where you have Splunk Light installed. You should be able to start Splunk Light using a web browser as follows: With a supported web browser, navigate to: http://hostname or ip address:8000, or enter localhost:8000 Use whatever host and port you chose during installation. When you tried to re-install Splunk Light, it seems you did not remove all instances of Splunk Light first (the Splunk directory), as you cannot install over an existing version unless you are upgrading. ... View more

Here is some documentation that might be helpful from the Forwarder Manual: Install a Windows universal forwarder from an installer: http://docs.splunk.com/Documentation/Forwarder/6.5.3/Forwarder/InstallaWindowsuniversalforwarderfromaninstaller (Be sure to configure the Deployment Server and the Receiving Indexer in steps 8 & 9.) Install a Windows universal forwarder from the command line: http://docs.splunk.com/Documentation/Forwarder/6.5.3/Forwarder/InstallaWindowsuniversalforwarderfromthecommandline (Be sure to specify a Deployment Server and the Receiving Indexer.) Here are some simple step-by-step instructions from a universal forwarder configuration in Splunk Light that might give you an idea of a basic configuration: http://docs.splunk.com/Documentation/SplunkLight/6.5.1612/GettingStarted/GettingdataintoSplunkLightusingWindows ... View more

See this documentation for information about using universal forwarders to get data into your Splunk Light cloud service. http://docs.splunk.com/Documentation/SplunkLight/6.5.1612/Cloud/ForwarddatatoSplunkLightcloudservice ... View more

Be sure you have followed the steps for installing the universal forwarder on Microsoft Windows. See http://docs.splunk.com/Documentation/SplunkLight/6.5.2/GettingStarted/GettingdataintoSplunkLightusingWindows Note, if using the installation wizard, be sure to configure the Deployment Server dialog (port 8089), and the Receiving Indexer dialog (port 9997). If using the command line, see http://docs.splunk.com/Documentation/Forwarder/6.5.2/Forwarder/InstallaWindowsuniversalforwarderfromthecommandline#Supported_command_line_flags and be sure to flag: RECEIVING_INDEXER="" and DEPLOYMENT_SERVER="" You should be able to see your forwarders on the System > Forwarder management page in Splunk Light. ... View more

App for AWS configuration menu in Splunk Light. ... View more

Toggle to the App for AWS menu and dashboard page. ... View more

Thanks for bringing this issue to our attention. This is a known issue for Splunk Light cloud service, v6.5.1612, and our dev team is addressing the issue to fix as soon as possible. I suggest continuing to access your dashboards through the URL until fixed. Apologies for the inconvenience at this time. ... View more

Glad it worked for you! ... View more

Try these instructions to configure the universal forwarder. There are seven steps at the top of this page, with each step details listed below on the page. Possibly you need to perform Step 6 and the deploy-poll command: http://docs.splunk.com/Documentation/Forwarder/6.5.2/Forwarder/HowtoforwarddatatoSplunkEnterprise ... View more

Possibly this Answers topic can help resolve your situation. I've also reached out to some others that might be able to offer some suggestions. https://answers.splunk.com/answers/455323/splunk-unable-to-fetch-windows-security-eventlogs.html ... View more

You can also see the Splunk Universal Forwarder "Forwarder Manual" and the "How to forward data to Splunk Enterprise" section at http://docs.splunk.com/Documentation/Forwarder/6.5.1/Forwarder/HowtoforwarddatatoSplunkEnterprise. The steps are listed 1-7 at the top of the topic, and you can scroll down for individual configuration steps/info. ... View more

I can't give any input about the messages you are receiving, but try reviewing these topics to confirm you have configured your forwarders and credentials correctly. http://docs.splunk.com/Documentation/Forwarder/6.5.1/Forwarder/HowtoforwarddatatoSplunkCloud http://docs.splunk.com/Documentation/SplunkCloud/6.5.1/User/ForwardDataToSplunkCloudFromWindows ... View more

If you haven’t resolved the issues with seeing your installed forwarders, try the following links and confirm you have performed the steps listed for setting up the universal forwarder with Windows and Linux for Splunk Cloud instances. The instructions are slightly different. http://docs.splunk.com/Documentation/SplunkCloud/6.5.1/User/ForwardDataToSplunkCloudFromWindows http://docs.splunk.com/Documentation/SplunkCloud/6.5.1/User/ForwardDataToSplunkCloudFromLinux ... View more

Glad you resolved the issues you were having. I reviewed our basic universal forwarder installation instructions with our QA, and they seem fine. Our QA person also reviewed the problems you were having, and he stated to be sure to search index=new index name. Basically, does your search contain a directive to look in the new index. It seems you also came to this conclusion. ... View more

I've been reviewing the issue about your data not being forwarded, and will continue my review/testing tomorrow with our QA. I'll get back to you with any further suggestions to resolve this issue. In the interim, a few questions/suggestions: - Did you "uncheck" the box at the beginning of the Windows universal forwarder installation wizard to indicate you want this forwarder to contact a cloud instance? - The forward-server command is only configured for on-premises instances. - The deploy-poll command is configured for both on-premises and cloud instances, but the Windows installer configures this as long as you add your cloud service hostname, such as "input-abc-d-12abcdefghij.cloud.splunk.com" during the wizard steps. For Mac and Linux installs, you have to to manually configure the deploy-poll command. - For cloud instances, it does take some time, such as 15 minutes or so, to have your forwarders and data display in your instance due to the instance talking to the cloud. - You can delete the forwarder and credentials and reinstall. If you do so, be sure to empty your trash and restart your system for a clean install, and follow each step of the installation instructions. ... View more

checking on some options to try and resolve your issue... ... View more

Sorry..yes, looks like you're using Windows ... View more

What operating system are you using? Windows? ... View more

Great to know it's working! ... View more

More specific instructions for event log monitoring and universal forwarder config info using Windows: http://docs.splunk.com/Documentation/Splunk/6.5.0/Data/MonitorWindowseventlogdata ... View more

Try the Splunk Enterprise Getting Data In manual, which has more information: http://docs.splunk.com/Documentation/Splunk/6.5.0/Data/AboutWindowsdataandSplunk ... View more