How do I install a universal forwarder on an IBM Logical Partition (LPAR)?
How do I load the Universal Forwarder on a IBMi LPAR?
View ArticleWhat are the main differences between the Universal forwarder and Heavy...
Can someone explain me in simply english the difference between there two forwards and where they are using?
View ArticleMonitoring specific keys in the registry
I had the default registry monitoring turned on for our desktops for a day but it used way too much of our license so I had to disable it. I am interested in monitoring a few keys but I am unclear on...
View ArticleHow do I reduce the number of Windows 4688 events generated by Splunk?
While logging Windows 4688 events I noticed that the Splunkd process is actually responsible for generating over 90% of the events. I am currently dropping the events generated by the Splunkd process...
View ArticleSplunk universal forwarder will not start. ERROR AdminHandler:ServerControl -...
Splunk Universal Forwarder running in windows. UF ver is 6.2.1 The very last entry in splunkd.log is 10-27-2017 16:19:19.825 -0400 ERROR AdminHandler:ServerControl - forcing shutdown since it did not...
View ArticleMissing events when using a universal forwarder
I was trying to do a batch input with a bunch of CSVs using a universal forwarder, really simple thing: inputs.conf: [batch://] move_policy=sinkhole index=myindex sourcetype=mysourcetype props.conf:...
View ArticleData is not getting indexed through Universal Forwarder
Hello All, We are forwarding data to indexer from Universal forwarder for couple of months perfectly. Recently we are facing issues that the forwarder is not sending files to indexer and I observed log...
View ArticleUsing Splunk Universal Forwarder to collect from ElasticSearch/Logstash
one of our end-user clients have massive information stored in ELK stack. Our company needs to collect those data into Splunk using Splunk Universal forwarder . They can't send us fluentd due to...
View ArticleSecuring Communications between Deployment Server to Forwarder (upgraded from...
I have recently upgraded from 6.5.x to 6.6.x and I am now encountering openSSL communication errors between my Deployment Server and Universal Forwarder. SSL encryption is configured for DS to FWD and...
View ArticleSymantec 14.0 and Splunk 7.0.0 (splunkd) not playing well together
Good afternoon, I have a problem with Symantec 14.0 and splunk 7 Universal Forwarder not playing well together. Whenever the forwarder is running, Symantic use goes to 99% for every 10 seconds out of...
View ArticleSplunk Universal Forwarder fails port scans on AIX 7.1 servers
I have several AIX servers (AIX 7.1) with Splunk Universal Forwarder 6.5.2 that all fail Nessus port scans for allowing TLS1.0 on port 8089. All configs, verified by btool, have "sslVersions" and...
View ArticleignoreOlderThan in inputs.conf
Hi All, We have Splunk environment with nearly 1000 Universal Forwarders sending logs to Indexers. These Universal Forwarders are managed by Deployment Server. Now the issue is few of the logs from a...
View ArticleUniversal Forwarderで時間指定のログ転送
日本語ですみません。 業務要件として、1日1回決められた時間（リアルタイムではなく）にUniversal Forwarderでログ転送する必要があります。 Universal Forwarderの機能で、決められた時間にログ転送する事は可能でしょうか？ 現在は、決められた時間直前にUniversal Forwarderを起動し、 ログの転送が終わる時間を見込んでUniversal...
View ArticleHow to get a list of all hosts installed with Universal Forwarder
I have a bunch of agents(hosts) in Appdynamics, I wanted to figure out that the Universal Forwarder is installed or not in all those hosts to collect logs to Splunk. **Is there any way that I can get...
View ArticleHow do I FULLY uninstall Splunk Universal Forwarder
I'm running Splunk Universal Forwarder with a Splunk Enterprise deployment. On a new install, all information is populating correctly into the Splunk App for Windows Infrastructure, including the...
View ArticleSplunk Universal forwarder not reporting data
we have some Universal forwarder Agents installed in servers in different domains , server team done patching on those servers and post patching or Server reboot , these are not reporting logs . Ours...
View Articleincorrect epoch times in netflow data from universal forwarder
I have Stream application installed on Universal Forwarder and I've setup streamfwd as a receiver for Netflow. To be more precise, my architecture is following one: - network traffic is mirrored to the...
View ArticleHow can I exclude data from being ingested by the universal forwarder?
Hello all, I have recently set up Splunk to monitor /var/log/messages. There is one event in this log that I would like to exclude. The event itself really does not matter. I would just like to know...
View ArticleTrouble getting the Windows universal forwarder to forward data
Hello all, I can't seem to get the windows universal forwarder to forward data. - Splunk indexer (7.x.x) is on CentOS7, 8089 and 9997 open on firewall - Latest Splunk forwarder installed on windows 10...
View ArticleUniversal Forwarder, Server Class.
I install UF on linux client. Than I ./splunk set deploy-poll *.*.*.*:8089 Client did not appear in Forwarder Management in Clients. What i miss?
View Article