How do you install and configure a Splunk Universal Forwarder on OS X?

[cpreasbeck]

Hello,

I need help installing the Universal Fowarder for OS X as well as configuring it. Is there a guide online that goes over this or can someone give me a step by step procedure please. I looked at the http://docs.splunk.com/Documentation/SplunkLight/latest/Installation but that doesn't seem to help at all.

Thanks

[ppablo · Accepted solution]

Hi @cpreasbeck

Is this the documentation you're looking for?
http://docs.splunk.com/Documentation/Splunk/6.2.2/Forwarding/Deployanixdfmanually#Install_the_univer...
http://docs.splunk.com/Documentation/Splunk/6.2.2/Installation/InstallonMacOS

[cpreasbeck]

When I download the universal forwarder it gives me a tar file. I unpack it and it provides me with a splunkforwarder folder and inside I don't see anything that pertains to installing it. This may be a dumb question but how do I get this installed? Is there another piece to the universal forwarder that needs to be installed first? Also once you get it installed how do I go about editing it so I can direct to grab logs from system.log and forward that out to the server?

Thanks much for the help!

[ppablo]

So I'm guessing you got as far as making sure the package name is /opt/splunkforwarder instead of just opt/splunk which is for a full instance as documented here:
http://docs.splunk.com/Documentation/Splunk/6.2.2/Forwarding/Deployanixdfmanually#The_package_name

Have you looked at the instructions following that section which covers starting and configuring the universal forwarder?
http://docs.splunk.com/Documentation/Splunk/6.2.2/Forwarding/Deployanixdfmanually#Configure_the_univ...