Splunk Enterprise version 7.3 is no longer supported as of October 22, 2021. See the Splunk Software Support Policy for details. For information about upgrading to a supported version, see How to upgrade Splunk Enterprise.
This documentation does not apply to the most recent version of Splunk® Enterprise.
For documentation on the most recent version, go to the latest release.
Install the Splunk universal forwarder
To forward your data into your Splunk Enterprise deployment, install the universal forwarder on your remote Windows host by completing the following steps:
- Download the Splunk universal forwarder.
- Double-click the MSI file to start the installation.
- Click View License Agreement.
- Select the Check this box to accept the License Agreement check box.
- To change any of the default installation settings, click Customize Options.
- Click Install to install the software with the defaults.
- (Optional) In the Receiving Indexer pane, enter a host name or IP address and the receiving port for the receiving indexer that you want the universal forwarder to send data to, and then click Next.
- Click Install. The installer runs and displays the Installation Completed dialog. The universal forwarder starts automatically.
- From the Control Panel, confirm that the
SplunkForwarderservice runs.
Last modified on 29 July, 2020
| Enable Windows data collection | Install the Splunk Add-on for Windows on universal forwarders |
This documentation applies to the following versions of Splunk® Enterprise: 7.2.0, 7.2.1, 7.2.2, 7.2.3, 7.2.4, 7.2.5, 7.2.6, 7.2.7, 7.2.8, 7.2.9, 7.2.10, 7.3.0, 7.3.1, 7.3.2, 7.3.3, 7.3.4, 7.3.5, 7.3.6, 7.3.7, 7.3.8, 7.3.9, 8.0.0, 8.0.1, 8.0.2, 8.0.3, 8.0.4, 8.0.5, 8.0.6, 8.0.7, 8.0.8, 8.0.9, 8.0.10
Download manual
Feedback submitted, thanks!