Getting Data In

How to configure a universal forwarder and what is my Splunk username?

rcecala
Engager

Hi,

I am new to splunk and I am trying to configure a host of mine to use a Splunk server (I think they call them forwarders?).
I have been trying to follow the instructions I found here:

http://answers.splunk.com/answers/50082/how-do-i-configure-a-splunk-forwarder-on-linux.html

I do not understand what I am suppose to do here:

Step 4: Enable Receiving input on the Index Server Configure the Splunk Index Server to receive data, either in the manager: Manager -> sending and receiving -> configure receiving -> new or via the CLI: /opt/splunk/bin/splunk enable listen 9997 Where 9997 (default) is the receiving port for Splunk Forwarder connections

Do I execute /opt/splunk/bin/splunk enable listen 9997 on the system I want to send my log files from or on the system I want to send my log files to?

Also I do not know my Splunk username? How can I figure that out?

# /opt/splunkforwarder/bin/splunk add forward-server hostname.domain:9997
Splunk username: i do not know it
Password:
Login failed
0 Karma

ChrisG
Splunk Employee
Splunk Employee

Glad you got the user name and password figured out. 🙂 There is a Forwarding Data manual that explains what forwarders are, how to configure them, and how to deploy them in various scenarios. The Answers post you are looking at was written for an earlier release of Splunk Enterprise. The specific menu path you are looking for is now Settings > Forwarding and receiving. The Settings menu is in the upper right of your Splunk Enterprise screen.

rcecala
Engager

Doh! Is the default admin/changme 🙂

MuS
SplunkTrust
SplunkTrust

HeHe, well done 🙂

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...