> For the complete documentation index, see [llms.txt](https://docs.cloudfabrix.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.cloudfabrix.io/rda/installation/log-shippers/splunk-forwarder-windows-and-linux.md).

# Splunk forwarder (Windows and Linux)

This section explains how you can configure 'Splunk' like a log shipper.

In order for the Splunk component to send the log details to the event gateway,  users have to configure two elements.

1. Event Gateway Endpoint
2. Splunk configuration on Linux/Windows configuration

**Step 1:** 

An example Event Gateway Endpoint configuration is captured in the below configuration snippet.

```
Gateway Endpoint:
endpoints:
- name: winodows_events
  enabled: true
  type: tcp_json
  port: 9997
  attrs:
    site_code: dc1
    archive_name: splunk_events
  stream: windows-splunk-stream 
```

**Step 2:** 

Update the input and output.conf file from the below path:

**Input conf file:**

```
cd /opt/splunkforwarder/etc/system/local/

##Example adding messages##
[monitor:///var/log/messages*]
_TCP_ROUTING = *
disabled = false
```

**outputs.conf file:**

```
[tcpout]
defaultGroup = default-autolb-group

[tcpout-server://<event-gateway>:9997]

[tcpout:default-autolb-group]
disabled = false
sendCookedData = false
server = <event-gateway>:9997

#Example 
[tcpout]
defaultGroup = default-autolb-group

[tcpout-server://10.95.131.101:9997]

[tcpout:default-autolb-group]
disabled = false
sendCookedData = false
server = 10.95.131.101:9997

```

**Step 3:**

Restart splunk service&#x20;

```
cd opt/splunkforwarder/bin
./splunk stop 
./splunk start
```