Start the universal forwarder

After you install the universal forwarder, you must start it before it can take configurations and forward data. The only exceptions are if you installed the forwarder with the Windows MSI or Mac OS X DMG packages. Those packages include logic that lets you accept the license agreement and start the forwarder automatically.

You must also start (or restart) the forwarder after you make changes to configuration files.

The following commands use environment variables that might not be automatically set on your host. The environment variables represent where the universal forwarder has been installed on the host. To learn how to set these environment variables, see Change default values in the Admin Manual.

Run the following commands to start the universal forwarder at any time. If this is the first start, the forwarder presents the license agreement, which you must read and accept to continue.

Unix	Windows
cd $SPLUNK_HOME/bin ./splunk start	cd %SPLUNK_HOME%\bin .\splunk start

If you want to accept the license agreement without reviewing it when you start the forwarder for the first time, run these commands.

Unix	Windows
cd $SPLUNK_HOME/bin ./splunk start --accept-license	cd %SPLUNK_HOME%\bin .\splunk start --accept-license

If you want to restart the forwarder after you make a configuration change, run these commands. When you do, the forwarder first stops itself, then starts itself again.

Unix	Windows
cd $SPLUNK_HOME/bin ./splunk restart	cd %SPLUNK_HOME%\bin .\splunk restart