Getting Data In

Universal Forwarder not sending monitor after installing Splunk App for Windows Infrastructure

Path Finder

I installed the Splunk App for Windows Infrastructure using the following Splunk guide: I set up my the Splunk deployment server on my Splunk Enterprise Instance. For some reason, the Splunk Forwarder that I set up to be a client of this server is no longer sending the logs from the monitor that I defined in C:\Program FIles\SplunkUniversalForwarder\etc\apps\SplunkUniversalForwarder\local\inputs.conf. 

The Splunk Windows Add-on and the Splunk App for Windows Infrastructure is working correctly and is sending the Windows logs to the deployment server. 

I believe I need to change something in the setting of the deployment server/clients/server class to get my monitor to send the logs to the "main" index but I don't know what to change.


Labels (2)
0 Karma



This has nothing to do with the app.

Please check the below.

1) Can you please check whether the role that run splunkd has access to the data to be monitored.

2) Does the client is forwarding internal logs to the main splunk instance. index=_internal host="client"

3) Does the client communicating to the deployment server? settings -> forwarder management

4) if all the above checks out, please look for errors in the splunkd logs on the client .



0 Karma

Path Finder

Some more information, when I do ./splunk list monitor on both the Splunk instance and the forwarder, the correct directories show up so they are recognized as inputs. I think the issue is therefore related to how I configured the "Universal Forwarders" server class or my clients in the deployment server.

0 Karma
Get Updates on the Splunk Community!

Splunk Security Content for Threat Detection & Response, Q1 Roundup

Join Principal Threat Researcher, Michael Haag, as he walks through:An introduction to the Splunk Threat ...

Splunk Life | Happy Pride Month!

Happy Pride Month, Splunk Community! 🌈 In the United States, as well as many countries around the ...

SplunkTrust | Where Are They Now - Michael Uschmann

The Background Five years ago, Splunk published several videos showcasing members of the SplunkTrust to share ...