Hello,
I want to push the data to Universal forwarder, so that forwarder can forward the data to the Indexer.
I have Splunk installed on Server_1 and on Server_2 I have universal forwarder installed.
I am executing my .net code from Server_2 which posts a simple text message to forwarder and forwarder needs to push this data to Server_1. How can this be done? what all changes needs to be done to the .conf files?
I have already added Receiver on Server_1 and able to get Windows Event log data from Server_2 - this proves that the forwarder is actually forwarding the data to Server_1
I am able to create a new tcp port using Data Inputs->Tcp option on Server_1 and from Server_2 using my .net code I am able to post the data, but now, instead of posting it directly to Server_1 I want to post it to universal forwarder on Server_2 so that universal forwarder takes care of forwarding the data.
Hope, I am clear with my requirement 🙂
Thanks!!
I was able to find the answer for my question:
We need to add the following stanza in inputs.conf on the system where Universal Forwarder is installed.
[tcp://33333]
sourcetype=log4net
disabled=false
On a windows based system inputs.conf can be found at the below location
$SPLUNK_HOME/etc/apps/MSICreated/local/
I was able to find the answer for my question:
We need to add the following stanza in inputs.conf on the system where Universal Forwarder is installed.
[tcp://33333]
sourcetype=log4net
disabled=false
On a windows based system inputs.conf can be found at the below location
$SPLUNK_HOME/etc/apps/MSICreated/local/