Splunk Enterprise

Universal forwarder - configuration

verifi81
Path Finder

Hello,

On a Universal Forwarder can someone tell me where the config is that tells the universal forwarder where to send the logs?

I need this for Windows and Linux.

Thank you

Labels (1)
0 Karma
1 Solution

verifi81
Path Finder

I found it. 

It's under $SPLUNK_HOME/etc/apps/search/local/

The file is outputs.conf

 

View solution in original post

0 Karma

vikramyadav
Contributor

I'm not sure which log file you are interested in so you can use btool to check outputs.conf

For Linux and Linux

$Splunk_Home/splunk btool outputs list --debug

 

-------------------------------------

If this help your like will be appreciated 🙂

 

0 Karma

verifi81
Path Finder

appreciate the quick response, but that video and blog did not tell me which file to view those settings at. My universal forwarders are already forwarding to an index and I'm simply trying to find which file I can CAT to view the indexer.  

0 Karma

vikramyadav
Contributor
0 Karma

verifi81
Path Finder

I found it. 

It's under $SPLUNK_HOME/etc/apps/search/local/

The file is outputs.conf

 

View solution in original post

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!