Splunk® Universal Forwarder

Forwarder Manual

Download manual as PDF

Download topic as PDF

Enable a receiver

To enable forwarding and receiving, you must configure both a forwarder and a receiver. The receiver is the Splunk instance that receives the data. The forwarder sends data to the receiver.

The forwarder connects to the receiver on its receiving network port and sends data to the receiver for as long as it can see the receiver. If you configure the receiver to connect to more than one indexer, it performs load balancing between the available indexers.

The receiver is either a Splunk indexer or another forwarder (referred to as an "intermediate forwarder") that you configure to receive data from other forwarders. The receiver can also be multiple indexers at one time.

On the universal forwarder, you have two options to configure receiving:

  • Use the Splunk Command Line Interface (CLI).
  • Edit the inputs.conf configuration file.

A best practice for configuring forwarding is to set up receivers first. You can then set up forwarders to send data to that receiver.

Set up receiving with Splunk CLI

  1. To enable receiving, run the command line interface (CLI) command:
    splunk enable listen <port> -auth <username>:<password>
    
  • <port> is the port you want the receiver to listen on (the receiving port). For example, if you enter 9997, the receiver receives data on port 9997.
  • By convention, receivers listen on port 9997, but you can specify any unused port. You can use a tool like netstat to determine what ports are available on your system. When you choose a port, confirm that the port you select is not in use.

The splunk enable listen command creates a [splunktcp] stanza in inputs.conf. For example, if you set the port to 9997, it creates the stanza [splunktcp://9997].

Set up receiving with configuration files

You enable receiving on your Splunk instance by configuring inputs.conf in $SPLUNK_HOME/etc/system/local.

  1. To enable receiving, add a [splunktcp] stanza that specifies the receiving port. In this example, the receiving port is 9997:
    [splunktcp://9997]
    disabled = 0
    
  2. Restart Splunk software for the changes to take effect.

The forms [splunktcp://9997] and [splunktcp://:9997] (one colon or two) are semantically equivalent.

PREVIOUS
How to forward data to Splunk Enterprise
  NEXT
Install the universal forwarder software

This documentation applies to the following versions of Splunk® Universal Forwarder: 6.4.0, 6.4.1, 6.4.2, 6.4.3, 6.4.4, 6.4.5, 6.4.6, 6.4.7, 6.4.8, 6.5.0, 6.5.1, 6.5.2, 6.5.3, 6.5.4, 6.5.5, 6.6.0, 6.6.1, 6.6.2


Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters