Splunk® Universal Forwarder

Forwarder Manual

Installation overview

To deploy the universal forwarder:

  1. Make sure you fulfill the necessary prerequisites. See Universal forwarder prerequisites.
  2. Install the universal forwarder:
  3. To send data to Splunk Enterprise, enable a Splunk Enterprise indexer receiver. See Enable a receiver for Splunk Enterprise.
  4. To send data to Splunk Cloud Platform, you must obtain permissions to use the Splunk Cloud indexer. See Install and configure the Splunk Cloud Platform universal forwarder credentials package.
  5. (Optional) To further modify how data is sent to the indexer, configure the universal forwarder. See Configure the universal forwarder using configuration files.
  6. Start or restart the universal forwarder. See Start or stop the universal forwarder.
Last modified on 24 April, 2025
Universal forwarder deployment prerequisites   Install a Windows universal forwarder

This documentation applies to the following versions of Splunk® Universal Forwarder: 9.4.0, 9.4.1, 9.4.2

Acrobat logo Download manual
Acrobat logo Download this page

Please expect delayed responses to documentation feedback while the team migrates content to a new system. We value your input and thank you for your patience as we work to provide you with an improved content experience!

Was this topic useful?







You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters