Start the universal forwarder

After you install the universal forwarder, it must be started and running before it can forward data. If you make changes to the forwarder configuration using either files or the CLI, you must start (or restart) the forwarder in most cases.

Commands for starting the universal forwarder

The following commands use environment variables that might not be automatically set on your machine. The environment variables represent where the universal forwarder has been installed on the machine. See Change default values in the Admin Manual to learn how to set these environment variables.

Run the following commands to start the universal forwarder at any time. If this is the first time the forwarder has started, and you have not included parameters to avoid prompts or automatically accept the license agreement, the forwarder performs the following:

• Prompts you to accept the license agreement. You must read and accept it to continue.
• Prompts you to create an administrator password. The password you create must meet eligibility requirements.

• If you want to start the universal forwarder, run this command.

  Unix	Windows
  cd $SPLUNK_HOME/bin ./splunk start	cd %SPLUNK_HOME%\bin .\splunk start

• If you want to accept the license agreement without reviewing it when you start the forwarder for the first time, run this command.
  

  Unix	Windows
  cd $SPLUNK_HOME/bin ./splunk start --accept-license	cd %SPLUNK_HOME%\bin .\splunk start --accept-license

• If you want to restart the forwarder after you make a configuration change, run this command. When you do, the forwarder first stops itself, then starts itself again.
  

  Unix	Windows
  cd $SPLUNK_HOME/bin ./splunk restart	cd %SPLUNK_HOME%\bin .\splunk restart

The universal forwarder prompts for administrator credentials the first time you start it

When you start the forwarder for the first time under most conditions, it prompts you to create a password for the Splunk administrator user. The following text appears:

This appears to be your first time running this version of Splunk.

An Admin password must be set before installation proceeds.
Password must contain at least:
* 8 total printable ASCII character(s).
Please enter a new password:

You must type in a password that meets the requirements that the prompt displays. See Create a secure administrator password in Securing Splunk for additional information about creating a secure password.