Install UF or LF on each vCenter machine

You can use a Splunk UF or LF to forward the data from your vCenter Server to the Indexer.

To download the Universal Forwarder (UF)

1. Go to www.splunk.com and click the Free Download button.
2. Select the Universal Forwarder link on the page. The Download Splunk Universal Forwarder page opens where you can select the forwarder version you need.

To download a Light Forwarder

1. Go to www.splunk.com and click Free Download button to download a full version of Splunk.
2. Click on the Splunk version for your target OS to begin the download.
3. When the download is complete, configure the Splunk instance as a LF.

Configure forwarding

Configure the forwarder on your vCenter Server machines to send data to your indexer(s) in the outputs.conf file. Do this for each forwarder installed on a vCenter machine. For more information about setting up forwarding for your indexers, see Configure forwarders with outputs.conf in the Splunk Distributed Deployment Manual.

For a single indexer configuration:

1. Use the splunkadmin user to log into vCenter and enter the following:

   splunk add forward-server <host>:<port>

   For example,

   splunk add forward-server splunkindexer.company.com:9998

2. Now enter the default Splunk credentials to log into the Splunk forwarder on the vCenter, or use the credentials you created. The default username is admin and the password is changeme.
3. Check that the indexer is active and that you can forward data to it. Run the command:

   splunk list forward-server.

4. The indexer to which you are forwarding data is added the list of active forward servers.

You can now forward data from the vCenter to your indexer/search head.

To learn more about installing and configuring forwarders, in the Splunk Distributed Deployment Manual:

• See "Types of forwarders" .
• See Introducing the universal forwarder" .
• See "Deploy a forwarder" .