Splunk Universal Forwarder - selection of types of data to be transmitted

[bogdan_nicolesc]

Hi, All,

I r baboon.

I try to configure Universal Forwarder, but it seems that somewhere i'm doing wrong.

First of all, specifically, i want to know if somewhere in Splunk folder or UF, resides an config file where i can write what data to send, like syslog, security and all of that, what types of data i can get out of my machine.

This is the first point of interest.

Anything else of UF config i don't need right now, because where i work i'm working in a medium where don't have full control of IT infrastructure, like the ability to open ports and all that. I don't even have admin rights on my local machine :)))

Thank you.
Bogdan

[bogdan_nicolesc]

Hi All,

First of all, thank you for your fast response.

Second of all, i managed to solve the problem.

From what i have read in all of that documentation, i couldn't make it because when you setup your receiver, you need to specify in your >Local inputs< what type of data to get in >Local event log collection<.

I have selected ForwardedEvents and now i can get some data in.

Correct me if i'm wrong, but i guess this is the wrong solution xD :))

Also, i had to make indexes for what indexes i get from forwarder in receiver.

Thank you,
Bogdan

[dkeck]

HI,

you should have a look at this

http://dev.splunk.com/view/dev-guide/SP-CAAAE3A

if you are working with forwarder, you are looking for inputs.conf. This is the file you have to configure to get your data sources set up. Then you need outputs.conf to send this data to your indexer.

[deepashri_123]

Hey@bogdan_nicolescu,

You can refer this doc to configure universal forwarder:
https://docs.splunk.com/Documentation/Forwarder/7.2.3/Forwarder/Configuretheuniversalforwarder
https://docs.splunk.com/Documentation/Forwarder/7.2.3/Forwarder/HowtoforwarddatatoSplunkEnterprise

Let me know if this helps!!