Stop the universal forwarder
You must stop the universal forwarder if you do not want it to forward data any more, or as part of a restart sequence when you make a configuration change that requires a restart.
The following commands use environment variables that might not be automatically set on your host. The environment variables represent where the universal forwarder has been installed on the host. To learn how to set these environment variables, see Change default values in the Admin Manual.
To learn how to start or restart the universal forwarder, see Start the universal forwarder.
Start the universal forwarder
Configure forwarding with outputs.conf
This documentation applies to the following versions of Splunk® Universal Forwarder: 184.108.40.206, 8.2.4, 8.2.5
Feedback submitted, thanks!