Install a universal forwarder on each Microsoft Active Directory host
Install the universal forwarder on Windows
Install the universal forwarder on Windows as follows:
- Install the universal forwarder in
\Program Files\SplunkUniversalForwarderon the system drive, which is the drive that boots your Windows host.
- Install the universal forwarder with the default management port of TCP/8089.
- Configure the universal forwarder to run as the Local System user.
- Create a Splunk administrator password.
- Enable the Application, System, and Security Windows Event Log data inputs.
Install the forwarder on Windows with the default options
- Download the universal forwarder from splunk.com.
- Double-click the MSI file to start the installation.
- To view the license agreement, click the View License Agreement button.
- Select the Check this box to accept the License Agreement check box.
- To change any of the default installation settings, click the Customize Options button. Otherwise, click Install to install the software with the defaults.
Perform at least one of the following two steps. Otherwise, the universal forwarder cannot send data anywhere:
- (Optional) In the Deployment Server pane, enter a host name or IP address and management port for the deployment server that you want the universal forwarder to connect to, and click Next.
- (Optional) In the Receiving Indexer pane, enter a host name or IP address and the receiving port for the receiving indexer that you want the universal forwarder to send data to, and click Next.
- Click Install to proceed. The installer runs and displays the Installation Completed dialog. The universal forwarder starts automatically.
- From the Control Panel, confirm that the
Install with customized options
When you chose to customize options in the universal forwarder setup dialog box, the installer presents you with the following options:
- (Optional) Click Change to specify a different installation directory.
- (Optional) Select an SSL certificate to verify the identity of this machine. Depending on your certificate requirements, you might need to specify a password and a Root Certificate Authority (CA) certificate to verify the identity of the certificate. Otherwise, leave these fields blank.
- Select the Local System or Domain Account check box and click Next. If you specify Local System, the installer displays the Enable Windows Inputs dialog box. If you specify Domain Account, the installer displays a second dialog box where you enter your domain and user information.
- If you selected Domain Account, the installer displays a dialog box with user name and password credentials. Enter the user name and password into the User name and Password fields. Specify the user name in
- Enter the password again in the Confirm password field.
- To add the domain user you specified to the local Administrators group, select Add user as local administrator and click Next. The installer adds the domain user you specified to the local Administrators group.
- (Optional) Select one or more Windows inputs from the list and click Next.
- Create a password for the Splunk
adminuser and click Next.
- (Optional) Enter the hostname or IP address and management port for your deployment server and click Next.
- (Optional) Enter the hostname or IP address and receiving port and click Next.
- Click Install.
Considerations for enabling data inputs in the installer
If you enable data inputs in the Enable Inputs dialog box when installing the universal forwarder, the installer also installs the Splunk Add-on for Windows. It saves the configuration that enables those inputs into the add-on. This configuration includes index definitions.
This means that the receiving indexer that this forwarder sends data to must already have the following indexes defined:
perfmonfor Performance Monitoring inputs.
windowsfor generic Windows inputs.
wineventlogfor Windows Event Log inputs.
By default, indexers do not have these indexes defined. Either define the indexes before performing a universal forwarder installation, or install the Splunk Add-on for Windows onto the indexer.
Information on Windows third-party binaries that ship with the universal forwarder
For information on third-party Windows binaries provided with the Windows version of the universal forwarder, see the Information on Windows third-party binaries distributed with Splunk Enterprise topic in the Splunk Enterprise Installation Manual.
Configure your Microsoft Active Directory domain to generate audit events
Install the Splunk Add-on for Microsoft Active Directory on your distributed Splunk Enterprise deployment
This documentation applies to the following versions of Splunk® Enterprise: 7.2.0, 7.2.1, 7.2.2, 7.2.3, 7.2.4, 7.2.5, 7.2.6, 7.2.7, 7.2.8, 7.2.9, 7.3.0, 7.3.1, 7.3.2, 8.0.0