Splunk Enterprise

Universal forwarder - configuration

verifi81
Path Finder

Hello,

On a Universal Forwarder can someone tell me where the config is that tells the universal forwarder where to send the logs?

I need this for Windows and Linux.

Thank you

Labels (1)
0 Karma
1 Solution

verifi81
Path Finder

I found it. 

It's under $SPLUNK_HOME/etc/apps/search/local/

The file is outputs.conf

 

View solution in original post

0 Karma

vikramyadav
Contributor

I'm not sure which log file you are interested in so you can use btool to check outputs.conf

For Linux and Linux

$Splunk_Home/splunk btool outputs list --debug

 

-------------------------------------

If this help your like will be appreciated 🙂

 

0 Karma

verifi81
Path Finder

appreciate the quick response, but that video and blog did not tell me which file to view those settings at. My universal forwarders are already forwarding to an index and I'm simply trying to find which file I can CAT to view the indexer.  

0 Karma

vikramyadav
Contributor
0 Karma

verifi81
Path Finder

I found it. 

It's under $SPLUNK_HOME/etc/apps/search/local/

The file is outputs.conf

 

0 Karma
Get Updates on the Splunk Community!

Security Highlights: September 2022 Newsletter

 September 2022 The Splunk App for Fraud Analytics (SFA) is now Splunk SupportedUse your existing Splunk ...

Platform Highlights | September 2022 Newsletter

 September 2022 What’s New in 9.0 and How to UpgradeGet a walk through of what is new Splunk Enterprise 9.0 ...

Observability Highlights | September 2022 Newsletter

 September 2022 Splunk Observability SuiteAccess to "Classic" SignalFx Interface Will be Removed on Sept 30, ...