Getting Data In

Universal Forwarder

dking307
New Member

I have universal forwarder installed on a Windows 2008 box. I have a directory c:\logs\firewall setup where I am pointing the Windows firewall logs. I want to have the universal forwarder pick these up and send them to the indexer. I am newb and have read through the doc and its not really clear to me on how to do this. I know I need to edit the inputs.conf but I am not sure of the syntax.

Any help is appreciated.

0 Karma

jbsplunk
Splunk Employee
Splunk Employee

Just edit your inputs.conf in $SPLUNK_HOME/etc/system/local/. If inputs.conf doesn't exist, add the file.

Do something like this:

[monitor:://C:\Logs\firewall]
disabled = 0 
sourcetype = my_sourcetype
host = my_hostname

For details, see:

http://www.splunk.com/base/Documentation/latest/admin/inputsconf

I hope this points you in the right direction.

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

actually: [monitor://c:\\c:\logs\firewall], i.e., only one colon. You don't need the disabled=0 clause, that's default, and most of hte time you don't need the hostname if the local forwarder host is correct.

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...