Configure forwarding
You must forward the data collected from the FA VM to your indexers. Configure your forwarders to do this. For more information about setting up forwarding for your indexers, see Configure forwarders with outputs.conf in the Splunk Distributed Deployment Manual.
For a single indexer configuration:
- Use the splunkadmin user to log into the FA VM and enter the following:
splunk add forward-server <host>:<port>
- For example,
splunk add forward-server splunkindexer.company.com:9997
- Now enter the default Splunk credentials to log into the Splunk forwarder on the FA, or use the credentials you created for the FA. The default username is
admin
and the password ischangeme
. - Check that the indexer is active and that you can forward data to it. Run the command:
splunk list forward-server
.
- The indexer to which you are forwarding data is added the list of active forward servers.
Install the Perl API package into the FA VM | Configure engine.conf |
This documentation applies to the following versions of Splunk® App for VMware (Legacy): 1.0, 1.0.1, 1.0.2, 1.0.3, 2.0
Feedback submitted, thanks!