Getting Data In

Confused about the data

SLowry
New Member

I've enabled Forwarding & Receiving to accept input from the Universal Forwarder that I installed on my servers. Using Wireshark I know data is being sent to the Splunk server. I'm confused about the next steps in terms of indexing the data. Where is it being stored on my server? Do I need to add files on the server? How does the data get to them?

Thanks

0 Karma
1 Solution

Ayn
Legend

You add data inputs on the Universal Forwarders. The forwarders will read data from these inputs and forward that data to the main Splunk indexer. The indexer stores this data in its index, typically in $SPLUNK_HOME/var/lib/splunk, where $SPLUNK_HOME usually is /opt/splunk in *NIX installations and C:\Program Files\Splunk in Windows installations.

View solution in original post

Ayn
Legend

You add data inputs on the Universal Forwarders. The forwarders will read data from these inputs and forward that data to the main Splunk indexer. The indexer stores this data in its index, typically in $SPLUNK_HOME/var/lib/splunk, where $SPLUNK_HOME usually is /opt/splunk in *NIX installations and C:\Program Files\Splunk in Windows installations.

SLowry
New Member

Thanks. You got me moving in the right direction.

0 Karma

DaveSavage
Builder

Slowry - Ayn is right - post your q's re WI and Windows Mgmt as new q's - the tagging system works in your favour and you will be able to see 'related' if not similar q's people have had. The user experience on the App's release page makes for good reading at http://splunk-base.splunk.com/apps/22315/splunk-app-for-windows
Br, Dave

0 Karma

Ayn
Legend

That's a separate question regarding those specific apps - best idea would be to post that on its own and tag it correctly, so people with knowledge of those apps (I don't have that, sorry) can see and respond.

SLowry
New Member

OK, I see lots of data in the Main file. That's good.
I have Windows Intelligence & Windows Management Apps installed. How do I tell them to use the Main index? I see Indexes for WI, but they are empty, I don't think that's correct, but I don't know how to get the data to them.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...