I'm trying to view Windows Logs. I installed the universal forwarder on the local Windows PC.
I configured only for local system, not remote. I added new receiver port 9997 on the server & restarted Splunk.
But when I go to Add data from Windows Logs, still asks me to install univ. forwarder and when I got to server, doesn't list the receiver I added. When I try to re-add it, it shows me this:
"Encountered the following error while trying to save: In handler 'cooked': Failed to create. Configuration for port 9997 already exists."
Splunk 4.3 Server is running on Linux.
You cannot configure the inputs on the Splunk server. YOu'll need to do that on the forwarder located on your windows PC. Here's what you need to do:
http://docs.splunk.com/Documentation/Splunk/5.0/Deploy/Setupforwardingandreceiving
1) Enable the receiver on splunk server for port 9997 ( Done )
2) Edit outputs.conf on the forwarder to tell it to send to your reciever.
http://docs.splunk.com/Documentation/Splunk/5.0/Deploy/Configureforwarderswithoutputs.confd
3) Configure inputs.conf on the forwarder.
It's not too bad at all. Steps 2 and 3 are a couple of lines each in two configuration files. Once you get the hang of where the files are etc...it's smooth sailing. Then on a larger scales we have the deployment mananger so you can edit something once and push it out to many servers.
Seems to be too much work to get Windows logs into Splunk!