Im using powershell to install universal forwarders on the new machines that im spinning up using the following command: cmd /c "msiexec.exe /i splunkforwarder-6.2.1-245427-x64-release.msi AGREETOLICENSE=Yes RECEIVING_INDEXER='simdc01:9997' MONITOR_PATH='c:\logs' PERFMON=cpu,memory,network,diskspace /quiet" But this does not create an outputs.conf file containing the tcp settings so im doing this in powershell to manually create the file needed $outputsConfString = @" [tcpout] defaultGroup = indexers [tcpout:indexers] server = simdc01:9997 "@ New-Item "C:\Program Files\SplunkUniversalForwarder\etc\system\local\outputs.conf" -type file -force -value $outputsConfString My question is, is there a way to do this via the CLI or am i stuck with this hack? It feels wrong to have to hack files in this way when there is tooling provided to automate things. ... View more

I've followed the documentation best i can to create an instance of splunk enterprise on one windows server Then added port 9997 as a receiving datat port on this admin page "http://localhost:8000/en-US/manager/search/data/inputs/tcp/cooked" Then on a different server I've installed a universal forwarder. then added c:\logs as a monitor folder using the CLI command .\splunk.exe add monitor c:\logs The confirmation "Added monitor of 'c:\logs'." was displayed. After doing all this the logs still don't appear in the splunk web interface! Is there a log i can look in to see if the files in the logs folder are getting sent or if there is an error? i'm not sure what i'm missing now. all running on windows 2012 R2 64bit cheers Damo ... View more