Install and Configure the Splunk Universal Forwarder on Windows
Learn how to install the Splunk Universal Forwarder on Windows, collect event logs, configure an indexer and deployment server, and verify data delivery.
The Splunk Universal Forwarder is a lightweight agent installed on a data-producing computer. It collects selected local data, such as Windows Event Logs, and sends that data to Splunk infrastructure.
In a typical deployment, the Windows host runs the forwarder, an indexer receives and stores the forwarded data, and an optional deployment server distributes configuration and apps to managed forwarders. The indexer receiving connection and deployment-server management connection serve different purposes.
This guide covers an interactive installation on Windows, including the common option to collect the Application, System, and Security Windows Event Logs.
Understand the Universal Forwarder Architecture
A forwarder is a Splunk component that sends collected data to another Splunk component. The Universal Forwarder is optimized for data collection and forwarding rather than interactive searching or indexing.
- Universal Forwarder: Runs on the Windows host, reads selected local inputs, and forwards events.
- Indexer: Receives, processes, stores, and makes data searchable. Its receiving endpoint is often called the receiver.
- Deployment server: Optionally manages deployment clients by distributing apps and configuration updates.
The forwarder uses one connection for management traffic to a deployment server and another for data traffic to an indexer. A common arrangement is deployment-server management on TCP port 8089 and indexer receiving on TCP port 9997.
| Source Component | Destination Component | Traffic Purpose | Common Port |
|---|---|---|---|
| Universal Forwarder | Deployment server | Registration and centrally distributed configuration | 8089 |
| Universal Forwarder | Indexer receiver | Splunk-to-Splunk event forwarding | 9997 |
Port numbers can be changed by an administrator. Always use the values configured in your environment.
Plan the Installation
- Identify the Windows workstation or server that will produce the data.
- Confirm the correct Universal Forwarder package for the Windows version and processor architecture.
- Record the receiving indexer hostname or IP address and its configured receiving port.
- Decide whether a deployment server will manage this forwarder. If so, record its hostname or IP address and management port.
- Verify that the Windows host can resolve and reach the indexer and, if applicable, the deployment server.
- Arrange local Windows administrative privileges for the person running the installer.
The indexer receiver must be enabled before the forwarder can deliver events. Network firewalls must also permit the required outbound connections from the Windows host.
Record the planned settings
| Setting | Purpose | Typical Default or Example | Required or Optional |
|---|---|---|---|
| Installation directory | Location of the Universal Forwarder files | C:\Program Files\SplunkUniversalForwarder\ | Required; custom location is optional |
| Forwarder service account | Windows identity used by the forwarder service | Local System | Required |
| Windows event log inputs | Specifies local logs to collect | Application, System, Security | Selectable |
| Deployment server hostname | Identifies the optional configuration manager | <deployment-server-hostname-or-ip> | Optional |
| Deployment server management port | Connects the deployment client to the deployment server | 8089 | Optional when deployment server is used |
| Indexer hostname | Identifies the receiving Splunk indexer | <indexer-hostname-or-ip> | Required for forwarding |
| Indexer receiving port | Accepts forwarded Splunk data | 9997 | Required for forwarding |
Download the Windows Universal Forwarder
Obtain the Windows Universal Forwarder installer from Splunk's official download location. Select a package that matches the target Windows operating system and architecture, then save the downloaded installer where you can access it with administrative privileges.
The package is used to begin the setup process. Before opening it, confirm that the downloaded file is intended for the host and that your organization permits the selected Splunk version.
Run the Interactive Installer
1. Launch setup
Open the downloaded installer file. If Windows requests elevation, approve it. If setup fails to start or cannot create services and directories, close it and relaunch it with sufficient local administrative rights.
2. Review the installation directory
The standard installation directory is:
C:\Program Files\SplunkUniversalForwarder\Keep the default location unless your operating system layout, storage policy, or software-management standard requires another path. A custom directory should be documented because it affects later service management and local configuration work.
3. Select the service account
The Universal Forwarder runs as a Windows service. The installer commonly offers the built-in Local System account as the default. This account is suitable for many local event-log collection scenarios.
Use a different service account only when organizational policy or the required data sources demand it. Validate that the selected identity can read every input that the forwarder must collect, especially Security events and protected files.
4. Select Windows Event Log inputs
The Windows installer workflow includes an option to collect Windows Event Logs. Common selections are Application, System, and Security.
| Event Log | Data Type | Operational Use | Permission Considerations |
|---|---|---|---|
| Application | Application-generated events | Application failures, warnings, and lifecycle information | Confirm the service can read the log |
| System | Operating system and service events | Driver, service, startup, and platform troubleshooting | Confirm the service can read the log |
| Security | Security and audit events | Authentication, authorization, and audit monitoring | Requires appropriate event-log access and depends on Windows auditing being enabled |
Select inputs that match your organization's logging and retention requirements. Selecting every available input is not automatically appropriate: unnecessary data increases volume and may send events to an unintended index or destination.
5. Configure the optional deployment server
A deployment server distributes applications and configuration updates to deployment clients such as Universal Forwarders. To register this host during installation, enter the deployment server hostname or IP address and its management port.
<deployment-server-hostname-or-ip>:8089Port 8089 is common, but the deployment server may use another configured management port. Registration is optional. If you skip it, the forwarder will not obtain centrally managed configuration through that deployment server until you configure the relationship later. You must supply inputs and other configuration locally or through another configuration-management method.
6. Configure the indexer receiver
Enter the hostname or IP address of the indexer that will receive the events and specify its Splunk-to-Splunk receiving port.
<indexer-hostname-or-ip>:9997Port 9997 is a common receiving port. It must be enabled on the indexer before forwarded data can arrive. Do not confuse this data connection with port 8089: 9997 carries forwarded events, while 8089 is commonly used for deployment-server management traffic.
7. Review and install
Review the installation directory, service account, selected event logs, deployment server settings, and indexer receiver settings. Start the installation only after confirming that the hostnames, ports, and data selections match the deployment plan.
Verify the Service and Data Flow
Verify the Windows service
When setup completes, confirm that the Universal Forwarder service starts. Open the Windows Services management console and locate the Splunk Universal Forwarder service. Check that its status is Running and that its startup behavior matches your operating requirements.
If the service is stopped, check the selected service account, permissions, installation logs, and forwarder logs. A successful installer window does not by itself prove that data is reaching the indexer.
Verify the indexer receiver and events
- Confirm the indexer receiver is enabled on the configured port.
- Confirm DNS resolution or network connectivity from the Windows host to the indexer.
- Check firewall and network-policy rules for the receiving port.
- Verify the selected Application, System, and Security inputs are producing events in Windows Event Viewer.
- Search the intended Splunk destination for recent events and confirm the expected host and source information.
For background on receiver setup, see Set Up A Receiver. For Windows input concepts, see Windows Inputs.
Manage Configuration After Installation
A forwarder configured as a deployment client contacts its deployment server and can receive centrally distributed apps, inputs, and forwarding settings. The deployment server can make consistent changes across many Windows hosts.
When no deployment server is used, configure and maintain inputs and forwarding settings locally, or use an approved alternative configuration-management process. Adding a new Windows Event Log input or changing a monitored input requires an explicit configuration change and a subsequent verification.
Maintain a clear inventory mapping each forwarder to its Windows host, deployment server, indexer or indexer group, ports, selected data inputs, and intended Splunk destination. This mapping helps prevent duplicate collection, incorrect routing, and difficult troubleshooting.
For related forwarder concepts, read What Are Forwarders and Monitor Logs Using Forwarders. To collect additional local data, see Add Data To Splunk.
Troubleshoot Common Problems
The installer cannot complete or the service does not start
- Confirm that setup was run with local administrative privileges.
- Check whether a conflicting service or incomplete previous installation exists.
- Verify the selected service account and its required permissions.
- Check the Windows service state after installation.
- Review installer and forwarder logs for the failing step.
No events appear in Splunk
- Verify the indexer hostname, IP address, and receiving port.
- Confirm that the indexer is configured to receive data on that port.
- Check firewall and network-policy rules between the forwarder and indexer.
- Confirm that the relevant Windows Event Log input was selected or configured.
- Confirm that the forwarder service is running and that Windows is generating the expected events.
Centrally managed configuration does not arrive
- Verify the deployment server hostname and management port, commonly 8089.
- Confirm network access from the Windows host to the deployment server.
- Check that the forwarder was configured as a deployment client.
- Verify that the deployment server has assigned the correct applications and server classes to the client.
Security events are missing while other logs arrive
- Confirm that the Security input is enabled.
- Review the service account's event-log permissions and applicable local policy.
- Open Windows Event Viewer and verify that the expected security events exist.
- Confirm that Windows auditing is configured to generate the required events.
Exam-Relevant Notes
- The Universal Forwarder collects and sends data; the indexer receives, processes, stores, and makes that data searchable.
- A deployment server is optional and distributes configuration; it is not the destination for indexed event data.
- TCP 8089 is commonly associated with deployment-server management, while TCP 9997 is commonly used for indexer receiving.
- The Windows installer can select Application, System, and Security Event Logs by default workflow, but the selected inputs must match organizational requirements.
- The Local System account is the common default Windows service account.
- Skipping deployment-server configuration means centralized configuration is not available through that deployment server until configured later.