# Setting Up Splunk Universal Forwarder on Windows and Linux for your home lab
A Splunk Forwarder is a lightweight agent installed on data-generating hosts to collect, tag, and securely stream data (logs, metrics) to a central Splunk Indexer.This guide will walk you through the process of setting up the Splunk Universal Forwarder on Linux and Windows,connecting it to your Splunk server for log collection and centralized analysis purposes.
## I. Types of forwarders
There are three types of forwarders:
- The universal forwarder contains only the components that are necessary to forward data.
- A heavy forwarder is a full Splunk Enterprise instance that can index, search, and change data as well as forward it. The heavy forwarder has some features disabled to reduce system resource usage.
- A light forwarder is also a full Splunk Enterprise instance, with more features disabled to achieve as small a resource footprint as possible. The light forwarder has been deprecated as of Splunk Enterprise version 6.0. The universal forwarder supersedes the light forwarder for nearly all purposes and represents the best tool for sending data to indexers.
## II. Requirements
In this article,your home lab requires:
- A Windows machine (10/11)
- A Linux machine
- A [Splunk server](https://www.splunk.com/en_us/products/splunk-enterprise.html) has been already deployed
## III. Steps
### Step 1: Downloading installation package
Visit official [Splunk website](https://www.splunk.com/?locale=en_us),create an account and navigate to Universal Forwarder
Choose the corresponding version to your machine.You can download the installation package directly from this website or copy `wget` command and paste it to your terminal

You can also choose other package versions by clicking on Previous Releases
### Step 2: Installing Universal Forwarder
There are 2 ways to install Universal Forwarder on your machine.The first way is install via command-line,this way is working on both Linux and Windows.The second is via GUI but it is only working on Windows. In the following instructions I will show you both.

#### On Linux
- Use this `tar` command to unpack the `.tgz` file : `tar -xvzf "file_name"`.The instruction of using tar command is [here](https://)
(If you install `.rpm` file you need to use 7z or rpm2cpio command-line utilities to unpack it)
- Before installing the program you need to know these common command in this directory`/home/username/splunkforwarder/bin`:
-- start: to start the Forwarder
-- stop: to stop the Forwarder
-- restart: to restart the Forwarder
-- status: to check the status of the Forwarder
- Start the Forwarder with this command `./splunk start --accept-license` (use accept-license parameter to automatically accept license)
- Enter the admin name and password
- Check the status of the forwarder to ensure it is running correctly with this command `./splunk status`

#### on Windows
- Click on the `.msi` file
- Accept the license,in this home lab I will deploy Splunk forwarder on our own machine so choose on-premise option
- Enter the username and password
- I will use a Splunk Receiving Indexer as the Splunk server so skip the Deployment Server and enter IP address and port number for the Indexer(the server will listen on this port)

>[!Note] Note:
> - If you choose Customize Options you can config some basic log collecting options.The following section provides a detailed guide on configuring Splunk Universal Forwarder log collection by editing inputs.conf
> - Learn more about Splunk Deployment Server [here](https://help.splunk.com/en/splunk-enterprise/administer/update-your-deployment/9.4/deployment-server-and-forwarder-management/deployment-server-architecture) and how to config it properly [here](https://www.youtube.com/watch?v=2Ba_9kebof0&t=566s)

### Step 3: Configuring collecting and forwarding settings
From now on,configurations on both windows and linux are the same.You can either config with command-line or using any text editors to modify `.conf` files. Be careful when modifying those text files because you won't receive any error messages if your syntax is wrong.

1.Config `inputs.conf` file
This file on a Splunk Forwarder defines what data is collected and how it is sent to the Indexer. Navigate to `$SPLUNK_HOME/etc/apps/search/local` and open `inputs.conf`.Here are some common spec:
- disabled = <boolean> : whether or not the input is enabled,default value is 0 (enable)
- index = <string> : specifies the index where this input sends the data (optional),default value is the.Note that if you config a index in this file but that index hasn't been created on splunk server,the server will drop all the data in this input,default index (in most cases the default index is main)
- host = <string> : sets the hostname of executing
machine,default value is "$decideOnStartup"
- renderXml = <boolean> : whether or not the input returns the event data in XML (eXtensible Markup Language) format or in plain text,default value is false
- start_from = <oldest|newest> : how the input should chronologically read the Event Log channels,default value is "oldest"
- current_only = <boolean> : whether or not to acquire only events that arrive while the instance is running,default value is 0 (false)
- checkpointInterval = <integer> : how often, in seconds, that the Windows Event Log input saves a checkpoint(checkpoints store the eventID of acquired events.This lets the input continue monitoring at the correct event after a shutdown or outage),default value is 0

Examples:

[WinEventLog://Security]
checkpointInterval = 5
current_only = 0
disabled = 0
start_from = oldest

[WinEventLog://Microsoft-Windows-Sysmon/Operational]
disabled = 0
host = smith
index = Sysmon
renderXml = true
start_from = oldest

2.Config Forwarding Settings
The Forwarder needs to know where to send the data. You can configure this by navigating to `$SPLUNK_HOME/bin` and running this command:

./splunk add forward-server <indexer_ip_or_hostname>:<port>

the default port is 9997(the Indexer will listen on this port to receive data from Forwarder)
You can also modify `outputs.conf` file to define the destination

3.Config listening port on Splunk Server
Via Splunk web,navigate to Settings -> Forwarding and receiving -> Configure receiving and click "New Receiving Port"
Enter the port number and save

>[!NOTE] Note:
> You can modify other `.conf` files to manage data collection, routing, and server connections. These files are primarily stored in `$SPLUNK_HOME/etc/system/local/`.
> Visit [this link](https://help.splunk.com/en/data-management/splunk-enterprise-admin-manual/9.1/configuration-file-reference/9.1.9-configuration-file-reference) for more configurations.

### Step 4: Testing the Setup
- On Splunk Web interface,go to the Search & Reporting app to check whether the Server received logs or not

- If you don’t see any data coming from the Forwarder, check the logs on the Splunk Forwarder for any issues by navigating to `$SPLUNK_HOME\var\log\splunk\splunkd.log`.Look for any warnings or errors that might indicate issues with the connection.
- If you deploy the splunk server on a Windows machine you will need to config firewall rules to unblock incoming data on the listening port.

## Conclusion
By following this guide, you have successfully deployed the Splunk Universal Forwarder across both Windows and Linux environments. Centralizing your logs is a critical first step in gaining visibility into your infrastructure. From here, you can begin creating custom dashboards and alerts in Splunk Enterprise to monitor your systems effectively.