My problem like this https://answers.splunk.com/answers/209017/why-am-i-not-getting-data-from-the-splunk-app-for.html, but i can not find out solve in this post. Can anyone confirm exactly how the stream config is supposed to be setup on a universal forwarder and how the indexer is configured for each streamfwd source?
Splunk is version 6.4.2 with app for stream 6.5.1
The forwarder I'm testing with is version 6.4.2
↧