Configuration on Splunk Enterprise

1. Log in to the machine where Splunk Enterprise has been installed.

2. Open and log in to the Splunk Enterprise application.

3. Click Settings and Indexes, then click New Index.

   1. Enter the same index name given in the inputs.conf file in the Index Name field and select Search & Reporting from the App dropdown.

Index name configuration

App configuration

4. Click the Save button.

5. Click Settings and Forwarding & Receiving, then click the +Add new button under the Receive data section.

6. Type 9997 in the Listen on this port field and click the Save button.

Configure the receiving port