VMware ESXi and vSphere Cluster Management

Install and Configure the Splunk Universal Forwarder on Windows

Learn how to install the Splunk Universal Forwarder on Windows, collect Event Logs, configure indexer and deployment server connections, and validate forwarding.

The Splunk Universal Forwarder is a lightweight agent installed on a Windows host. It collects local data, such as Windows Event Logs and selected files, then forwards that data to a Splunk indexer.

A forwarder does not normally index or search data. The indexer receives, processes, stores, and makes events searchable. Search heads provide the search interface and coordinate searches. The forwarder is responsible for collection and transport.

Plan the installation

Before running the installer, identify the Windows computer that will run the forwarder and decide how it will be managed. A single host can use local configuration, while an enterprise normally uses a deployment server to distribute consistent settings.

  • Record the hostname or IP address of the receiving indexer and its receiving port. Port 9997 is commonly used, but your Splunk environment may use another port.
  • If centralized management will be used, record the deployment server hostname or IP address and its management port. Port 8089 is commonly used for this purpose.
  • Confirm DNS resolution and network reachability from the Windows host to every required endpoint.
  • Confirm that firewalls permit outbound traffic from the Windows host to the configured Splunk ports.
  • Decide whether collecting the Application, System, and Security Windows Event Logs is appropriate for the host.
  • Confirm that the installer account can install software and create or start a Windows service.
  • Confirm that the service identity can read every intended data source. Security events and protected files may require elevated rights.

Understand the endpoint roles

A receiving port accepts forwarded event data on an indexer or other receiver. A management port provides Splunk administration and deployment communication. These ports have different purposes and must not be interchanged.

Component | Purpose | Typical port | Configured on the forwarder | Required or optional

Deployment server | Distributes apps and configuration updates to forwarders | 8089 | Yes, when centralized management is used | Optional

Indexer receiver | Accepts forwarded data for indexing and storage | 9997 | Yes, when data should be sent directly | Required for immediate forwarding

Deployment-server configuration only registers the forwarder with the management system. It does not, by itself, define where event data is indexed. The forwarder still needs an output destination, either locally or through an app delivered by the deployment server.

Download the correct Universal Forwarder installer

  1. Use the official Splunk download location and select the Splunk Universal Forwarder package.
  2. Choose the Windows installer that matches the target operating system and processor architecture, such as 64-bit Windows.
  3. Check the release version against your organization's compatibility and support requirements.
  4. Validate the downloaded package according to organizational software-verification practices, such as checking its signature, checksum, or approved software repository record.

Do not install a package intended for a different operating system or architecture. Keep the installer filename and version in your deployment records.

Run the interactive Windows installation

Start Setup

Sign in with an account that has permission to install software, or launch the installer with appropriate administrative privileges. Start the downloaded installer and proceed through the setup screens.

The default installation directory is typically:

C:\Program Files\SplunkUniversalForwarder

Keeping the default directory is usually simplest because standard commands and operational procedures commonly reference it. Choose another directory only when storage, policy, or software-management requirements justify the change.

Choose the service account

The Windows service normally runs as the built-in Local System account. Local System is highly privileged on the local computer and is a convenient default for reading standard Windows Event Logs and local data.

If policy prohibits Local System, choose a dedicated Windows service account instead. Apply least privilege: grant only the rights needed to read the selected event logs and files, and verify that the account is allowed to run as a service. Test access to the Security log separately because it is more restricted than many other event sources.

Select Windows Event Log inputs

The installer can enable collection of these common channels:

  • Application: events generated by applications and services.
  • System: events generated by Windows components, drivers, and system services.
  • Security: authentication, authorization, audit, and other security-related events.

Enable channels that support your operational, audit, and security requirements. Do not enable every available channel without planning: high-volume or verbose channels can increase network traffic, index storage, and search cost. Security collection may require elevated privileges and depends on the local audit policy generating the events you expect.

Configure the optional deployment server

Enter a deployment server only when your Splunk environment provides one and you want this forwarder to receive centrally managed apps and configuration. Use the deployment server's management endpoint, commonly port 8089, not the indexer's receiving port.

A deployment server can later distribute inputs.conf, outputs.conf, and other app configuration. It is optional for a standalone installation.

Configure the receiving indexer

When the host should send data immediately, enter at least one receiving indexer hostname or IP address and its receiving port. The indexer must already have a receiver enabled on that port. Configuring a destination on the forwarder does not enable the receiver on the indexer.

For a basic single-indexer installation, keep the default directory and Local System account, enable Application, System, and Security collection if appropriate, enter the indexer and receiving port, and finish the installation.

Installer option | Typical default | When to change it | Operational impact

Installation directory | C:\Program Files\SplunkUniversalForwarder | Storage or organizational policy requires another path | Changes command paths and configuration locations

Service account | Local System | Security policy requires a dedicated identity | Changes which logs and files the service can read

Windows Event Log inputs | Application, System, and Security may be offered | Requirements or volume controls call for a narrower scope | Determines which events are collected and the resulting data volume

Deployment server | Not configured unless entered | Centralized configuration management is available | Registers the client for centrally distributed apps and settings

Receiving indexer | Not configured unless entered | Events must be sent immediately to an indexer | Defines the forwarding destination; the indexer receiver must be enabled

What the installer configures

Splunk settings are stored in configuration files. Exact file locations can vary by version and app, but local settings are commonly under the Universal Forwarder's etc\system\local directory.

Forwarding output: outputs.conf

outputs.conf defines the destination used by the forwarder. A conceptual single-indexer configuration is:

[tcpout]
defaultGroup = primary_indexer

[tcpout:primary_indexer]
server = indexer.example.internal:9997

Replace the example hostname and port with values approved for your environment. In a production deployment, prefer configuration delivered by an approved app or deployment process rather than unmanaged local edits.

Deployment client: deploymentclient.conf

deploymentclient.conf identifies the deployment server:

[deployment-client]

[target-broker:deploymentServer]
targetUri = deployment.example.internal:8089

The target URI uses the deployment server management endpoint. It is not the data receiver and does not replace the tcpout destination.

Windows inputs: inputs.conf

inputs.conf defines local data inputs. These entries illustrate the three common Windows Event Log channels:

[WinEventLog://Application]
disabled = 0

[WinEventLog://System]
disabled = 0

[WinEventLog://Security]
disabled = 0

Use the actual configuration supplied by your Splunk administrator. Assigning indexes, sourcetypes, event filtering, and additional channels should follow your organization's data model and volume requirements.

Use a silent installation for managed deployments

For repeatable Windows deployment, an administrator can invoke the MSI installer from an elevated command prompt or software-distribution system:

msiexec /i splunkforwarder-<version>-x64-release.msi /quiet

Use the actual installer filename and organization-approved installation properties. Silent-install properties and supported options can vary by Universal Forwarder version, so verify them against the current Splunk documentation and test them before broad deployment.

Validate the installation

Check the Windows service

The service is normally named SplunkForwarder. From PowerShell, run:

Get-Service SplunkForwarder

From an elevated Command Prompt, you can also run:

sc query SplunkForwarder

The expected state is RUNNING. You can also open the Windows Services console and locate the SplunkForwarder service.

Check the installation and configuration

Verify that the installation directory exists and that the expected local configuration files are present. To inspect configured forwarding targets, run the command from an elevated prompt when required:

"C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe" list forward-server

If you selected a different installation directory, adjust the command path. Confirm that the displayed destination matches the intended indexer and receiving port.

Check connectivity and ingestion

  • Test DNS resolution for the indexer and, if used, the deployment server.
  • Test outbound connectivity from the Windows host to the indexer receiving port and deployment server management port, subject to your security policy.
  • Confirm that the indexer receiver is enabled and listening on the configured receiving port.
  • Search the target Splunk environment for a recent event from the Windows host, using the expected index, source, host, and time range.
  • Review forwarder logs if events do not arrive or a connection is repeatedly interrupted.

Validation item | How to check | Expected result | If unsuccessful

Forwarder service | Use Get-Service, sc.exe, or Services | SplunkForwarder is running | Check installation, service identity, Windows events, and forwarder logs

Indexer connectivity | Test DNS and the configured receiving port | The Windows host can reach the receiver | Check hostname, port, routing, firewall rules, and receiver status

Deployment server connectivity | Test the management endpoint and inspect client status | The forwarder can register and receive apps | Verify the target URI uses the management port and review deployment logs

Event ingestion | Search for recent events from the Windows host | Expected channels produce searchable events | Check inputs, index selection, time range, and indexer configuration

Forwarder logs | Review local Splunk logs for connection or input errors | No persistent errors explain missing data | Correct configuration, permissions, connectivity, or deployment precedence

Troubleshoot common problems

The service is not running

Possible causes include insufficient installation privileges, a service-account problem, endpoint-security interference, or an incomplete installation.

  • Inspect the SplunkForwarder service state.
  • Review local forwarder logs.
  • Review Windows Application and System event logs.
  • Confirm that the selected account can start the service and has the required local rights.

The forwarder runs but no events appear

Check the indexer hostname and receiving port, confirm that the indexer receiver is enabled, and test firewall and routing paths. Also verify that at least one input is enabled and that the search uses the correct index and time range. Forwarder logs can reveal connection failures, acknowledgments, or input errors.

The deployment server cannot be contacted

Verify the deployment server address and confirm that the target uses the management port, commonly 8089, rather than the receiving port. Check firewall access, endpoint availability, TLS or certificate requirements in secured environments, and whether the client is permitted to register.

Security events are missing

Confirm that the Security input is enabled and that the service identity can read the Security channel. Also confirm that local audit policy is generating the events. If no matching events exist locally, the forwarder cannot send them.

A local configuration change has no effect

Another app or configuration layer may have higher precedence, the file may be in the wrong directory, or a restart may be required. A deployment server may also replace local changes. Inspect the effective configuration and determine which centrally managed app controls the setting before editing it.

Operate the forwarder safely

  • Use a deployment server for repeatable configuration across many Windows hosts.
  • Monitor the forwarder service and forwarding health rather than relying only on one-time installation checks.
  • Document destination hosts, ports, collected inputs, assigned indexes, service identity, and deployment ownership.
  • Use least privilege when a dedicated service account is required.
  • Plan upgrades, restarts, and configuration changes through managed change and deployment processes.
  • Control the number and verbosity of collected channels to manage storage, network traffic, and search performance.

For a concise workflow, see the Windows Splunk forwarder installation guide.