Add the universal forwarder to the server class

Adding the universal forwarder that you installed in the previous step to the server class you defined on the deployment server is the final step in configuring the basic infrastructure for the Splunk App for Microsoft Exchange deployment. You can use this procedure to add universal forwarders and server classes as you need them.

Universal forwarder becomes deployment client

When you specified the deployment server during the universal forwarder installation process, the forwarder became a deployment client. Deployment clients connect to deployment servers to get Splunk apps and configurations, then activate and run those apps and configurations locally.

Earlier, you created the "send to indexer" app, which was an outputs.conf file that provided instructions on how to send data to the indexer. You configured this file to send data to the indexer you set up at the beginning of this process. Now, you will complete the loop and deploy the app to any deployment clients that connect to the deployment server.

Confirm that deployment server can see the deployment client

The first part of this step is to confirm that the universal forwarder you just installed phones home to the deployment server.

1. Log into the Splunk indexer you set up previously.
2. In the system bar, click Settings > Forwarder Management
3. Click the Clients tab. You should see the universal forwarder you installed in the previous step. If you don't, confirm that the forwarder service is active and that its configuration points to this deployment server.
4. Click the Server Classes tab.
5. In the server class you created earlier ("Universal Forwarders"), click Edit.
6. In the pop-up that appears, click Edit Clients. The "Edit clients" page loads.
   
   This page lists all clients that have connected to the deployment server. Those clients appear on the page below the Include, Exclude, and Filter by Machine Type controls at the top.
7. In the Include (whitelist) field at the top of the page, type in the host name of the deployment client.
8. Click Preview. The list updates to show you which clients match the string you entered in the "Include (whitelist)" field.
9. If the results look acceptable, click Save. The Forwarder Management page reappears and the deployment server deploys the "send to indexer" app to the deployment client.

Review server class status

To confirm that the deployment server has deployed the "send to indexer" app to the deployment client, revisit the server class properties page:

1. From the Forwarder Management page, select the server class you created earlier by clicking its name in the list.
2. Review the page.

• In the upper section, you should see the "sendtoindexer" app in the list of apps within the server class. On the right side of the page, in the "Clients" column, you should see that the app has been deployed to a client.
• In the lower section, you should see the universal forwarder you installed previously. On the right side of the page, in the "Deployed Apps" column, you should see that at least 1 app has been deployed.

If you don't see these entries, try the following steps to troubleshoot:

• Make sure the app is in the Splunk deployment apps folder on the deployment server.
• Confirm that you have configured the deployment client with the deployment server host name or IP address and management port.
• Confirm that you can contact the deployment server on its management port from the deployment client (make sure that a firewall does not block that access.)

Summary of basic infrastructure setup

To summarize, you have:

• Set up an indexer and configured it as a receiver.
• Created the "send to indexer" app, which tells universal forwarders to send data to this indexer.
• Activated deployment server by copying the "send to indexer" app from the Splunk apps directory to the deployment apps directory.
• Installed a universal forwarder and pointed it at the deployment server.
• Created a server class and added the "send to indexer" app and deployment client to the class.

You can use this procedure to add more apps and deployment clients to this server class. As clients come online and you add them to the server class, they get the "send to indexer" app which tells them to send data to the indexer. Once you bring all deployment clients online, you then complete basic setup of your Splunk App for Microsoft Exchange deployment.

If you need to make a change to the forwarding configuration, edit the outputs.conf file in the "send to indexer" app. After you restart Splunk Enterprise, the deployment server picks up the new changes and deploys them to all deployment clients that contact it. As you add indexers to scale the deployment, you can edit the configuration to instruct the deployment clients to send data to all indexers.

Next Step

The next step of setup is to get Exchange, Windows, and Active Directory data into the indexer.

Get Windows data: Download and configure the Splunk Add-on for Windows