Install a universal forwarder on your syslog-ng server

Install a universal forwarder with Linux

To install a universal forwarder and connect it to your Splunk platform deployment using Linux, perform the following steps:

1. Download the Splunk universal forwarder for Linux.
2. Install the universal forwarder.
3. Start the universal forwarder.
4. Configure the universal forwarder.
5. Enable forwarder management in Splunk Web.

Download the universal forwarder

1. Download the Splunk universal forwarder.
2. Choose the platform installation package that applies to your operating system.
3. Click Download Now.
4. Read and agree to the Splunk Software License Agreement.
5. Click Start Your Download Now.
6. Move the downloaded package to the directory where you want to install the universal forwarder.

Install the universal forwarder

Install the universal forwarder on the computer that contains or has access to the data that you want to collect and forward to your Splunk Enterprise instance. To install the universal forwarder on a different computer, copy the universal forwarder package file to that machine before you perform this task. The universal forwarder installs by default in the splunkforwarder directory.

To install in a specific directory, either change directories to where you want to install the forwarder, or place the tar file in that directory before you run the tar command.

• To expand the tar file into an appropriate directory using the tar command. The default installation location is under splunk in the current working directory:

tar xvzf splunkforwarder-<…>-Linux-x86_64.tgz

• To install into /opt/splunkforwarder, run the following command:

tar xvzf splunkforwarder-<…>-Linux-x86_64.tgz -C /opt

Start the universal forwarder

Start the universal forwarder so that it can take configurations and forward data.

1. Start the universal forwarder:

   cd $SPLUNK_HOME/bin ./splunk start

   When you start the forwarder for the first time, it prompts you to create an admin password:

   This appears to be your first time running this version of Splunk.
   
   An Admin password must be set before installation proceeds.
   Password must contain at least:
   * 8 total printable ASCII character(s).
   Please enter a new password:

2. The forwarder presents the license agreement. To accept the license agreement without reviewing it, run the following command:
   

   cd $SPLUNK_HOME/bin ./splunk start --accept-license

3. To confirm the forwarder is running, run a status command:
   

   $SPLUNK_HOME/bin ./splunk status

4. Restart the universal forwarder:

   cd $SPLUNK_HOME/bin ./splunk restart

Configure the universal forwarder to connect to the receiving port

From a shell or command prompt on the forwarder, run the following command:

./splunk add forward-server <host name or ip address>:<listening port>

For example, to connect to a receiver with the hostname idx.mycompany.com and with that host listening on port 9997 for forwarders, type this command:

./splunk add forward-server idx1.mycompany.com:9997