Splunk® Universal Forwarder

Forwarder Manual

Acrobat logo Download manual as PDF

This documentation does not apply to the most recent version of Splunk® Universal Forwarder. For documentation on the most recent version, go to the latest release.
Acrobat logo Download topic as PDF

Start the universal forwarder

After you install the universal forwarder, you must start it before it can take configurations and forward data. The only exceptions are if you installed the forwarder with the Windows MSI or Mac OS X DMG packages. Those packages include logic that lets you accept the license agreement and start the forwarder automatically.

You must also start (or restart) the forwarder after you make changes to configuration files.

The following commands use environment variables that might not be automatically set on your host. The environment variables represent where the universal forwarder has been installed on the host. To learn how to set these environment variables, see Change default values in the Admin Manual.

Run the following commands to start the universal forwarder at any time. If this is the first start, the forwarder presents the license agreement, which you must read and accept to continue.

Unix Windows
./splunk start
cd %SPLUNK_HOME%\bin
.\splunk start
  • If you want to accept the license agreement without reviewing it when you start the forwarder for the first time, run these commands.
    Unix Windows
    cd $SPLUNK_HOME/bin
    ./splunk start --accept-license
    cd %SPLUNK_HOME%\bin
    .\splunk start --accept-license
  • If you want to restart the forwarder after you make a configuration change, run these commands. When you do, the forwarder first stops itself, then starts itself again.
    Unix Windows
    cd $SPLUNK_HOME/bin
    ./splunk restart
    cd %SPLUNK_HOME%\bin
    .\splunk restart
  • Last modified on 17 April, 2018
    Make a universal forwarder part of a host image
    Stop the universal forwarder

    This documentation applies to the following versions of Splunk® Universal Forwarder: 7.0.0, 7.0.1, 7.0.2, 7.0.3, 7.0.4, 7.0.5, 7.0.6, 7.0.7, 7.0.8, 7.0.9, 7.0.10, 7.0.11, 7.0.13

    Was this documentation topic helpful?

    You must be logged into splunk.com in order to post comments. Log in now.

    Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

    0 out of 1000 Characters