I just walked through the process and these are my notes from doing so.
This is from a fresh install of Ubuntu 14.04 and a Windows 2008 R2 VM.
Splunk 6.2.1 was downloaded in a DEB package and installed to the Ubuntu VM with the command
sudo dpkg -i splunk-6.2.1-245427-linux-2.6-amd64.deb
Splunk was then started for the first time with
sudo /opt/splunk/bin/splunk start
Read though the license agreement and enter "y" when prompted.
Start up your web browser and connect to your Splunk instance at http://ip.address:8000
Enter "admin" and "changeme" for the username and password combination. Change it to something you know when prompted.
You should now be at the Splunk home screen.
Click on the Settings menu and then click "Forwarding and Receiving" from the list of options.
On the Forwarding and Receiving page, click "Configure Receiving". This will show the current receiver settings, if any, and allow you to create a new one.
Click the "New" button and enter "9997" to the "Listen on this port" box and then Save.
Splunk is now listening for forwarders on port 9997.
Nothing else needs to be done on the indexer/search head.
Validate that there are no events in Splunk by searching for “*” over all time.
Turn your attention to your forwarder. I am assuming the Spunk Universal Forwarder is already installed.
Create or Edit the inputs.conf file in $SPLUNK_HOME\etc\system\local. It should look like this:
[default]
host = windows_hostname
[WinEventLog::Application]
checkpointInterval = 5
current_only = 0
disabled = 0
evt_resolve_ad_obj = 1
start_from = oldest
[WinEventLog::Security]
checkpointInterval = 5
current_only = 0
disabled = 0
evt_resolve_ad_obj = 1
start_from = oldest
[WinEventLog::System]
checkpointInterval = 5
current_only = 0
disabled = 0
evt_resolve_ad_obj = 1
start_from = oldest
Create or Edit the outputs.conf file in $SPLUNK_HOME\etc\system\local. It should look like this:
[tcpout]
defaultGroup = default-autolb-group
[tcpout:default-autolb-group]
server = 192.168.84.145:9997
[tcpout-server://192.168.84.145:9997]
Restart the Splunk Universal Forwarder.
Go back to the web interface on the Splunk indexer/search head and re-run your search. You should now see events from Windows.
