Yes I did have a TCP port for the data. I deleted it, and added a port for receiving. When I go back to the app & select Setup, how do I configure the Add Data? If I select Data Type = IIS Logs, I can consume data on this server or Forward the logs from another server. When I select the Forward option, I just get the opportunity to download the universal forwarder. Rather than select 'IIS logs', I think I should use 'From Files and directories', but I don't know which one. ... View more

Fixed the problem. I created the index & specified a unique index 'firewall'. I re-installed & did not name the index. The app appears to be working now. I may have to modify the settings on the firewall, but so far so good. ... View more

Thanks. You got me moving in the right direction. ... View more

I thought I included the 'sudo' preface yesterday, maybe not. Anyway, when I run the command today nothing happens. Where should I see the results from the command? I have read about running the command as root or setuid root. Is that something I include in the saved searches or a configuration on the server? Thanks for the help. Sam ... View more

Worked like a champ! Thank you @MHibbin ... View more

Hi, am I understanding your question correctly: you would like to go back and install the server monitor/performance app which Splunk does during the msi install on windows? Also, do you use a deployment server? ... View more

I'm using Splunk 4.1. I finally found a setting in the General settings that allowed me to change the location. This not only created the folder but moved the contents from the previous folder. Very nice. Thanks for your help, I think it may have be relevant to an earlier release. ... View more

Splunk does not care where you install it - you could install it under C:\SLowry and it would work. However, once it is installed on Windows, wherever it is, don't move it. Splunk installs a service on a Universal Forwarder (UF) and that's why moving Splunk is a bad idea. On a UF, the installation directory ($SPLUNK_HOME) defaults to C:\Program Files\SplunkUniversalForwarder . (I think this is your case.) You don't need C:\Splunk\etc\apps . There will be a directory C:\Program Files\SplunkUniversalForwarder\etc\apps - that's where the Splunk_TA_Windows directory should go. So you should move it there (local directory and all). Finally, the configuration files appear to have nonstandard line endings for Windows. In text files, Linux ends lines with LF but Windows uses CRLF. All the files whose names end in .conf will be like this. Notepad will be confused, but I think Wordpad or Notepad++ will handle this correctly. I know that Komodo Edit (free version for Windows) will handle and convert line endings properly. There are other tools out there that will do the conversion as well. ... View more