# Configuration Reference for Splunk Forwarder To use the Splunk S2S Source connector, you must configure all of the following configuration properties on Splunk forwarders: 1. [sendCookedData](#sendcookeddata) 2. [useAck](#useack) 3. [useSSL](#usessl) 4. [Configure SSL communication for forwarders](#ssl-communication) 5. [Configure Forward Server on Forwarders](#forward-server) 6. [compressed](#compressed) ## sendCookedData Determines whether to send parsed data (event with metadata information) to the receiving server or not. For the connector, this config should be configured to `true`. - Type: boolean - Default: true ## useAck The Connector supports acknowledgements. If user wants to enable acknowledgements, this config should be configured to `true`. - Type: boolean - Default: false ## useSSL The Connector supports SSL. If user wants to enable SSL communication, this config should be configured to `true`. - Type: boolean - Default: false ## Configure SSL communication for forwarders - To configure the forwarder to connect to the connector using SSL, use the following `outputs.conf` settings: ```text [tcpout] defaultGroup=splunk_s2s_connector [tcpout:splunk_s2s_connector] server=: useSSL=true sslRootCAPath= /opt/splunk/etc/auth/mycerts/myCACertificate.pem ``` - To configure client authentication in SSL communication between the forwarder and the connector using `outputs.conf`, use the following `outputs.conf` settings: ```text [tcpout] defaultGroup=splunk_s2s_connector [tcpout:splunk_s2s_connector] server=: useSSL=true sslRootCAPath= /opt/splunk/etc/auth/mycerts/myCACertificate.pem clientCert = /opt/splunk/etc/auth/mycerts/myClientCert.pem sslPassword = myCertificatePassword ``` For more details, see [Configure Splunk forwarding to use your own SSL certificates](https://docs.splunk.com/Documentation/Splunk/8.2.2/Security/ConfigureSplunkforwardingtousesignedcertificates) ## compressed The Splunk S2S Source connector supports compression. If you want to enable compression between forwarders and the connector, you should set `compressed` to `true`. - Type: boolean - Default: false ## Configure Forward Server on Forwarders - To configure the forwarder to connect to the Connector using the Splunk CLI, run the following command: ```bash $SPLUNK_HOME/bin/splunk add forward-server : ``` - To configure the forwarder to connect to the Connector using `outputs.conf`, use the following `outputs.conf` settings: ```text [tcpout] defaultGroup=splunk_s2s_connector [tcpout:splunk_s2s_connector] server=: useACK=false useSSL=false sendCookedData=true ``` For more details, see [Configure forwarding with outputs.conf](https://docs.splunk.com/Documentation/Forwarder/8.1.3/Forwarder/Configureforwardingwithoutputs.conf) ### Configure Inputs on Splunk Forwarder ## File Monitor Input You can configure monitoring file and directories using the CLI: ```bash $SPLUNK_HOME/bin/splunk add monitor ``` - The following example shows how to monitor files in the `/var/log/` directory: ```bash $SPLUNK_HOME/bin/splunk add monitor /var/log/ ``` - The following example shows how to monitor the `windowsupdate.log` file where Windows logs automatic updates: ```bash $SPLUNK_HOME/bin/splunk add monitor c:\Windows\windowsupdate.log ``` For more details, see [Configure File Monitoring Using CLI](https://docs.splunk.com/Documentation/Splunk/8.1.3/Data/MonitorfilesanddirectoriesusingtheCLI). To configure monitoring files and directories using `inputs.conf`, see [Configure File Monitoring with inputs.conf](https://docs.splunk.com/Documentation/Splunk/8.1.3/Data/Monitorfilesanddirectorieswithinputs.conf#Configure_file_monitoring_with_inputs.conf). ## Scripted Input To configure scripts: 1. Place the scripts in the `$SPLUNK_HOME/bin/scripts` directory. 2. Configure scripted data input by editing the `$SPLUNK_HOME/etc/system/local/inputs.conf` file. Here is an example stanza: ```text [script://$SPLUNK_HOME/bin/scripts/starter_script.sh] disabled = false host = some_host_value index = main interval = 30 source = my_db sourcetype = my_db_data ``` #### NOTE If the `inputs.conf` file doesn’t exist, create the file manually. For more details regarding scripted input, see [Configure Scripted Input](https://docs.splunk.com/Documentation/SplunkCloud/8.1.2103/AdvancedDev/ScriptedInputsIntro). ## Syslog Input You can configure Syslog Input on Splunk universal forwarder by adding a network input to the forwarder(UF): - Using CLI: > ```bash > $SPLUNK_HOME/bin/splunk add udp|tcp -sourcetype syslog > ``` - Using Configuration file `inputs.conf`. Here is an example stanza: > ```text > [tcp://:] > connection_host = dns > sourcetype = syslog > ``` For more details regarding Syslog input, see [Monitor Network Ports on Splunk forwarder.](https://docs.splunk.com/Documentation/Splunk/8.1.3/Data/Monitornetworkports) ## Windows Event Log #### NOTE Windows Event Log Input is only available on forwarders that are installed on Windows machines. To configure the Windows event log: - Edit the `inputs.conf` configuration file located at `$SPLUNK_HOME\etc\system\local\inputs.conf` by adding the following settings (you may need to create this file if it doesn’t exist): > ```text > # Windows platform specific input processor. > [WinEventLog://Application] > disabled = 0 > [WinEventLog://Security] > disabled = 0 > [WinEventLog://System] > disabled = 0 > ``` - To configure Windows event log input to render event data as XML, configure the `renderXml` setting in the `inputs.conf` file as shown in the following example: ```text [WinEventLog://Security] disabled = 0 renderXml = 1 ``` For more details regarding windows event log input, refer to [Monitor Windows Event Log](https://docs.splunk.com/Documentation/SplunkCloud/8.1.2103/Data/MonitorWindowseventlogdata).