Getting Data In

pushing data to Universal forwarder from .Net

raghu_vaidya
Explorer

Hello,
I want to push the data to Universal forwarder, so that forwarder can forward the data to the Indexer.
I have Splunk installed on Server_1 and on Server_2 I have universal forwarder installed.
I am executing my .net code from Server_2 which posts a simple text message to forwarder and forwarder needs to push this data to Server_1. How can this be done? what all changes needs to be done to the .conf files?

I have already added Receiver on Server_1 and able to get Windows Event log data from Server_2 - this proves that the forwarder is actually forwarding the data to Server_1

I am able to create a new tcp port using Data Inputs->Tcp option on Server_1 and from Server_2 using my .net code I am able to post the data, but now, instead of posting it directly to Server_1 I want to post it to universal forwarder on Server_2 so that universal forwarder takes care of forwarding the data.
Hope, I am clear with my requirement 🙂

Thanks!!

0 Karma
1 Solution

raghu_vaidya
Explorer

I was able to find the answer for my question:
We need to add the following stanza in inputs.conf on the system where Universal Forwarder is installed.

[tcp://33333]
sourcetype=log4net
disabled=false

On a windows based system inputs.conf can be found at the below location
$SPLUNK_HOME/etc/apps/MSICreated/local/

View solution in original post

0 Karma

raghu_vaidya
Explorer

I was able to find the answer for my question:
We need to add the following stanza in inputs.conf on the system where Universal Forwarder is installed.

[tcp://33333]
sourcetype=log4net
disabled=false

On a windows based system inputs.conf can be found at the below location
$SPLUNK_HOME/etc/apps/MSICreated/local/

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...