Getting Data In

what is the difference in configuration between forwarders for receiving and sending

windyita
New Member

I have read another Q&A
http://answers.splunk.com/answers/50082/how-do-i-configure-a-splunk-forwarder-on-linux
but I'm confused whether the steps should be done on the receiver or the sender.
thanks in advance

Tags (2)
0 Karma
1 Solution

MuS
SplunkTrust
SplunkTrust

Hi windyita,

universal forwarder is the sender and indexer is the receiver, so

  • Steps 1-3 are obviously done on the universal forwarder
  • Step 4 is done on the indexer which is the receiver, if it has not been done before. This is a one time action.
  • Steps 5-7 are done on the universal forwarder

hope this helps ...

cheers, MuS

View solution in original post

0 Karma

MuS
SplunkTrust
SplunkTrust

Hi windyita,

universal forwarder is the sender and indexer is the receiver, so

  • Steps 1-3 are obviously done on the universal forwarder
  • Step 4 is done on the indexer which is the receiver, if it has not been done before. This is a one time action.
  • Steps 5-7 are done on the universal forwarder

hope this helps ...

cheers, MuS

0 Karma

windyita
New Member

I actually did as what you have said, but in step 7:
Step 7: Add Data:

/opt/splunkforwarder/bin/splunk add monitor /path/to/app/logs/ -index main -sourcetype %app%

This will create a file: inputs.conf in /opt/splunk/etc/apps/search/local/

Note: System logs in /var/log/ are covered in the configuration part of Step 7. If you have application logs in /var/log/*/

I didn't find inputs.conf in /opt/splunk/etc/apps/search/local/

What is the reason ? thx

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...