Universal Forwarder is not forwarding data to Splunk indexer

Applicability

Universal Forwarder

Description

Splunk Universal Forwarder is not forwarding data as expected due to a misconfigurations of $SPLUNK_HOME/etc/system/local/outputs.conf

Investigation

The following error message is seen in $SPLUNK_HOME/var/log/splunk/splunkd.log on the Universal Forwarder:

'09-06-2019 10:53:39.389 -0400 ERROR TcpOutputProc - LightWeightForwarder/UniversalForwarder not configured. Please configure outputs.conf.'

Resolution

This error message can be resolved by configuring the following settings in the $SPLUNK_HOME/etc/system/local/outputs.conf file:
 

[tcpout]defaultGroup = <target_group>, <target_group>, ...
* A comma-separated list of one or more target group names, specified later in [tcpout:<target_group>] stanzas.
* The forwarder sends all data to the specified groups.
* If you don't want to forward data automatically, don't set this setting.
* Can be overridden by an inputs.conf '_TCP_ROUTING' setting, which in turn can be overridden by a props.conf or transforms.conf modifier.
* Starting with version 4.2, this setting is no longer required.

 

[tcpout:<target_group>]server = [<ip>|<servername>]:<port>, [<ip>|<servername>]:<port>, ...
* A comma-separated list of one or more systems to send data to over a TCP socket.
* Required if the 'indexerDiscovery' setting is not set.
* Typically used to specify receiving Splunk systems, although you can use it to send data to non-Splunk systems (see the 'sendCookedData' setting).
* For each system you list, the following information is required:
a. The IP address or server name where one or more systems are listening.
b. The port on which the syslog server is listening.

Further examples of outputs.conf can be found in the following:
outputs.conf.example

Configure forwarders with outputs.conf

Once configured save the file and restart Splunk by using the following command run from $SPLUNK_HOME/bin

./splunk restart

 

Related Links

outputs.conf.example

Configure forwarders with outputs.conf

Revision History

Revision	Publish Date	Comments
1.0	28-Sep-2026	Initial Release