Installing Splunk Universal Forwarder
If you have chosen an architecture option where uberAgent interacts with Splunk through Splunk’s Universal Forwarder you need to install Universal Forwarder on every machine along with uberAgent.
The following description shows you how to install and configure Universal Forwarder for uberAgent. In this example, the Splunk server’s FQDN is
Launch the Universal Forwarder MSI file. Accept the license agreement and click Next.
If you have Splunk Enterprise you can use Splunk’s Deployment Server functionality to deploy apps. In that case specify the Splunk server name. You can leave the port empty to use the default. If you have Splunk Free leave both fields empty.
Specify the name of your Splunk Indexer. In this simple walkthrough our Splunk server also acts as indexer. Again, the port is left at the default value:
If you want Universal Forwarder to handle all Splunk communications you need to configure uberAgent to pass its output to Universal Forwarder on the same machine. To do that, open a TCP port uberAgent can send data to by adding the following to
$SPLUNK_HOME\etc\system\local\inputs.conf on your Universal Forwarders:
[tcp://127.0.0.1:19500] connection_host = none sourcetype = dummy listenOnIPv6 = no acceptFrom = 127.0.0.1 # Optionally write the stream to a disk buffer before processing. # Useful for machines with only intermittent connectivity to the Splunk backend, e.g. laptops. # More information: http://docs.splunk.com/Documentation/Splunk/latest/Data/Usepersistentqueues # Uncomment next line to enable persistent queueing: # persistentQueueSize = 100MB
$SPLUNK_HOME refers to the base directory of the Splunk (Forwarder) installation, typically
If you are deploying the
uberAgent_endpoint app port 19500 is opened for you automatically (details).
Universal Forwarder includes the Splunk Add-on for Windows which can be used to collect additional data uberAgent deliberately does not provide because it is available via Universal Forwarder. These additional data sources include log files, event logs, file system changes, printer and print job data, Active Directory objects and changes.
A default installation of Universal Forwarder sends all data from the Windows Application, Security and System event logs to Splunk. If you do not need that edit
$SPLUNK_HOME\etc\apps\Splunk_TA_windows\local\inputs.conf so that all stanzas are disabled as in the following example:
[WinEventLog://Application] disabled = 1 [WinEventLog://Security] disabled = 1 [WinEventLog://System] disabled = 1
You can find all the information required for automating the deployment of Universal Forwarder here.
If you intend to copy the installation via an imaging method or Citrix PVS you need to remove instance-specific information such as server name and GUID from the Universal Forwarder installation. To do that follow these steps right before capturing the image:
- Stop the service
SplunkForwarder(but leave the start type at
- Open an administrative command prompt
- Run the command:
C:\Program Files\SplunkUniversalForwarder\bin\splunk clone-prep-clear-config
- Prepare the machine for cloning as necessary, but do not reboot