DESKTOP SPLUNK FORWARDER WINDOWS

The global stanza in nf lets you set any attributes that you want to apply globally. For example, if you specify compressed=true for a target group, the forwarder sends the hosts in that target group compressed data, even if you set the compressed attribute to 'false' for the global level. (Optional) You can specify configuration values for single servers (receivers) within a target group.Ĭonfigurations at the more specific levels take precedence over the global level. Most configuration settings can be specified at the target group level. There can be multiple target groups per output processor. A target group defines settings for one or more receiving indexers. (Optional) At the global level, you specify any attributes that you want to apply globally, as well as certain attributes only configurable at the system-wide level for the output processor. You can configure the tcpout processor at three levels of stanzas: The universal forwarder only has the tcpout processor, which uses the header in nf. There are two types of output processors for forwarding data: tcpout and syslog. The universal forwarder must be restarted after you make changes to nf.įor information on nf, see the nf spec file. For purposes of distribution and management simplicity, you can combine settings from all non-default versions into a single custom nf file. If a copy of the file already exists in that directory, because of configuration changes made through the CLI, edit that copy. You should work with a single copy of the file, which you place in $SPLUNK_HOME/etc/system/local/. In addition to any nf files that you create and edit indirectly (for example, through the CLI), you can also create or edit an nf file directly with a text editor.

DESKTOP SPLUNK FORWARDER WINDOWS

The Windows installation process writes configuration changes to an nf file located in the MSICreated app.If you use the CLI to make changes to universal forwarder output behavior, the CLI creates or edits a copy of nf in $SPLUNK_HOME/etc/system/local.The locations of those versions vary, depending on the type of forwarder and other factors. The forwarder automatically creates or edits custom versions of nf in response to the first three methods. While installing the forwarder (on the Windows universal forwarder only.).There are several ways you can specify forwarding behavior: When you configure forwarding behavior, those changes get saved in custom versions of nf. The default version in the SplunkUniversalForwarder app has precedence over the version under /etc/system/default.ĭo not edit default versions of any configuration files. Another in $SPLUNK_HOME/etc/apps/SplunkUniversalForwarder/default.One in $SPLUNK_HOME/etc/system/default.

The universal forwarder ships with these default versions of nf:

The forwarder contains both default and custom nf files. No matter how many nf files the forwarder has and where they reside, the forwarder combines all their settings, using the rules of configuration file precedence.

For example, one can be located in an apps directory and another in $SPLUNK_HOME/etc/system/local. Restart the universal forwarder to complete your changes.Ī single forwarder can have multiple nf files.Add a minimum of at least one forwarding target group or a single receiving host. Open nf for editing with a text editor.

Go to the configuration directory for the forwarder.On the host that forwards that data that you want to collect, open a shell or command prompt or PowerShell window.For an example of what an nf file looks like, see 'Examples of nf' later in this topic. You might have to edit the file in other places, as sections in this topic explain. This procedure details the steps you must take to edit the default nf which is in $SPLUNK_HOME/etc/system/local. See Add data and configure inputs in Getting Data In.Įdit nf to configure forwarding To specify the data that you want to collect from the forwarder, you must separately configure the inputs, as you would for any Splunk instance. The topics that describe various forwarding topologies, such as load balancing and intermediate forwarding, provide detailed examples on configuring nf to support those topologies.Īlthough nf is a required file for configuring forwarders, it addresses only the outputs from the forwarder, where you want the forwarder to send the data it collects. You can specify some output configurations at installation time (Windows universal forwarders only) or the CLI, but most advanced configuration settings require that you edit nf. The nf file defines how forwarders send data to receivers.

Desktop splunk forwarder