Hi All,
I have installed splunkforwarder-6.0.3 on windows server and configured .conf as below. Please let me know if am missing anything.
[monitor:://C:\Program Files (x86)\Hitachi ID\Telephone Password Manager\Logs\TEST-PSYNCH\idmsuite.log]
disabled = 0
sourcetype = my_sourcetype
host = my_hostname
[tcpout]
autoLB = true
compressed = false
defaultGroup = wdc
[tcpout:wdc]
server = servername.com:9997,servername.com:9997
useACK=true
This is first time i have installed splunk. Do i need to configure anything from indexer side?
Thanks!
Hi @kpavan
Yup, you have to configure your indexer to receive data from your universal forwarder. Check out this documentation on enabling your receiver/indexer:
http://docs.splunk.com/Documentation/Splunk/6.0.3/Forwarding/Enableareceiver