{"id":196,"date":"2026-03-07T14:25:38","date_gmt":"2026-03-07T14:25:38","guid":{"rendered":"http:\/\/securitylearning.ir\/?post_type=knowledgebase&p=196"},"modified":"2026-03-08T11:40:13","modified_gmt":"2026-03-08T11:40:13","slug":"uf-%d8%a8%d8%b1%d8%a7%db%8c-%d8%a7%d8%b3%d9%be%d9%84%d8%a7%d9%86%da%a9","status":"publish","type":"knowledgebase","link":"https:\/\/securitylearning.ir\/index.php\/knowledge-base\/splunk\/uf-%d8%a8%d8%b1%d8%a7%db%8c-%d8%a7%d8%b3%d9%be%d9%84%d8%a7%d9%86%da%a9\/","title":{"rendered":"UF \u0628\u0631\u0627\u06cc \u0627\u0633\u067e\u0644\u0627\u0646\u06a9"},"content":{"rendered":"\n

\u0628\u0639\u062f \u0627\u0632 \u0646\u0635\u0628 UF<\/code> \u0631\u0648\u06cc \u0648\u06cc\u0646\u062f\u0648\u0632 \u0645\u06cc \u062a\u0648\u0627\u0646 \u0648\u0627\u0631\u062f \u0645\u0633\u06cc\u0631 \u0632\u06cc\u0631 \u0634\u062f \u0648 \u062f\u0633\u062a\u0648\u0631 \u0632\u06cc\u0631 \u0631\u0627 \u062a\u0627\u06cc\u067e \u06a9\u0631\u062f \u062a\u0627 \u0628\u0628\u06cc\u0646\u06cc\u0645 \u0622\u06cc\u0627 \u0633\u0631\u0648\u06cc\u0633 \u062f\u0631 \u062d\u0627\u0644 \u0627\u062c\u0631 <\/bdo><\/p>\n\n\n\n

cd C:\\Program Files\\SplunkUniversalForwarder\\bin>
splunk.exe status<\/code><\/p>\n\n\n\n

\u062f\u0631 \u0644\u06cc\u0646\u0648\u06a9\u0633 \u0645\u0633\u06cc\u0631 \u067e\u06cc\u0634\u0641\u0631\u0636 \u0628\u0631\u0627\u06cc \u0646\u0635\u0628 \u0627\u0633\u067e\u0644\u0627\u0646\u06a9 \u062f\u0631 \u0645\u0633\u06cc\u0631 \u0632\u06cc\u0631 \u0645\u06cc \u0628\u0627\u0634\u062f :<\/p>\n\n\n\n

\/opt\/splunkforwarder<\/code><\/p>\n\n\n\n

dpkg -I splunk***.deb<\/code><\/p>\n\n\n\n

dpkg xvfz splunk***.tgz \/opt
cd \/opt\/splunkforwarder\/bin
.\/splunk start -accept-license<\/code><\/p>\n\n\n\n

\u0628\u0639\u062f \u0627\u0632 \u0627\u06cc\u0646 \u0645\u0631\u062d\u0644\u0647 \u0648\u0627\u0631\u062f \u0645\u0633\u06cc\u0631 \u0628\u0627\u0644\u0627 \u0634\u062f\u0647 \u0648 \u062f\u0633\u062a\u0648\u0631 \u0634\u0631\u0648\u0639 \u0631\u0627 \u0645\u06cc \u0632\u0646\u06cc\u0645. \u062f\u0631 \u0627\u06cc\u0646\u062c\u0627 \u0628\u0627\u06cc\u062f \u0646\u0627\u0645 \u06a9\u0627\u0631\u0628\u0631\u06cc \u0648 \u067e\u0633\u0648\u0631\u062f \u0631\u0627 \u0648\u0627\u0631\u062f \u06a9\u0646\u06cc\u0645 \u06a9\u0647 \u0628\u0639\u062f\u0627 \u0628\u0631\u0627\u06cc \u062a\u0646\u0638\u06cc\u0645\u0627\u062a \u0628\u0647 \u0622\u0646 \u0646\u06cc\u0627\u0632 \u062f\u0627\u0631\u06cc\u0645. <\/bdo><\/p>\n\n\n\n

\u0628\u0627 \u062f\u0633\u062a\u0648\u0631 splunk status<\/code> \u0645\u06cc \u062a\u0648\u0627\u0646\u06cc\u0645 \u0648\u0636\u0639\u06cc\u062a \u0627\u062c\u0631\u0627 \u0631\u0627 \u0628\u0628\u06cc\u0646\u06cc\u0645. <\/bdo><\/p>\n\n\n\n

\u062d\u0627\u0644 \u0628\u0627\u06cc\u062f \u062a\u0646\u0638\u06cc\u0645\u0627\u062a \u0645\u0631\u0628\u0648\u0637 \u0628\u0647 Forwarding<\/code> \u0631\u0627 \u0627\u0646\u062c\u0627\u0645 \u062f\u0647\u06cc\u0645 \u062a\u0627 \u0627\u0637\u0644\u0627\u0639\u0627\u062a \u0628\u0647 \u0633\u0645\u062a Indexer<\/code> \u0627\u0637\u0644\u0627\u0639\u0627\u062a \u0627\u0631\u0633\u0627\u0644 \u0634\u0648\u062f. <\/bdo><\/p>\n\n\n\n

\u062a\u0639\u0631\u06cc\u0641 Forwarding<\/code> : <\/bdo><\/p>\n\n\n\n

\u067e\u06cc\u06a9\u0631\u0628\u0646\u062f\u06cc UF<\/code> \u0628\u0631\u0627\u06cc \u0627\u062a\u0635\u0627\u0644 \u0628\u0647 \u062c\u0641\u062a \u0647\u0627\u06cc Indexer<\/code> \u0628\u0631\u0627\u06cc \u0627\u0631\u0633\u0627\u0644 \u0627\u0637\u0644\u0627\u0639\u0627\u062a .<\/bdo><\/p>\n\n\n\n

\u0627\u06cc\u0646 \u0627\u0637\u0644\u0627\u0639\u0627\u062a \u062f\u0631 \u0641\u0627\u06cc\u0644 outputs.conf<\/code> \u0630\u062e\u06cc\u0631\u0647 \u0634\u062f\u0647 \u0627\u0633\u062a. \u0645\u06cc \u0634\u0648\u062f \u0647\u0645 \u062f\u0627\u062e\u0644 \u0641\u0627\u06cc\u0644 \u062a\u063a\u06cc\u06cc\u0631\u0627\u062a \u0631\u0627 \u0627\u0639\u0645\u0627\u0644 \u06a9\u0631\u062f \u0648 \u0647\u0645\u0686\u0646\u06cc\u0646 \u0628\u0627 \u062f\u0633\u062a\u0648\u0631\u0627\u062a CLI<\/code> \u062a\u063a\u06cc\u06cc\u0631\u0627\u062a \u0631\u0627 \u0627\u0639\u0645\u0627\u0644 \u06a9\u0631\u062f. <\/bdo><\/p>\n\n\n\n

indexer<\/code> \u0631\u0648\u06cc \u067e\u0648\u0631\u062a \u06f9\u06f9\u06f9\u06f7<\/code> \u06af\u0648\u0634 \u0648\u0627\u06cc\u0633\u0627\u062f\u0647 \u0627\u0633\u062a \u0628\u0631\u0627\u06cc \u06af\u0631\u0641\u062a\u0646 \u0627\u0631\u062a\u0628\u0627\u0637\u0627\u062a. <\/bdo><\/p>\n\n\n\n

.\/splunk add forward-server <indexer-host:receiving-port><\/code><\/p>\n\n\n\n

\u0628\u0627 \u0632\u062f\u0646 \u062f\u0633\u062a\u0648\u0631\u0627\u062a \u0628\u0627\u0644\u0627 \u062a\u063a\u06cc\u06cc\u0631\u0627\u062a \u062f\u0631 \u0641\u0627\u06cc\u0644 \u0632\u06cc\u0631 \u0627\u0639\u0645\u0627\u0644 \u0645\u06cc \u0634\u0648\u062f :<\/bdo><\/p>\n\n\n\n

$SPLUNK-HOME\/etc\/system\/local\/outputs.conf<\/code><\/p>\n\n\n\n

C:\\Program Files\\SplunkUniversalForwarder\\etc\\system\\local>more outputs.conf<\/code>

[tcpout]
defaultGroup = default-autolb-group<\/code><\/p>\n\n\n\n

[tcpout:default-autolb-group]
server = 172.17.2.27:9997<\/code><\/p>\n\n\n\n

[tcpout-server:\/\/172.17.2.27:9997]<\/code><\/p>\n\n\n\n

\u0628\u0627 \u062f\u0633\u062a\u0648\u0631 \u0632\u06cc\u0631 \u0645\u06cc \u062a\u0648\u0627\u0646\u06cc\u0645 \u0627\u06cc\u0646 \u0641\u0648\u0631\u0648\u0627\u0631\u062f\u0631 \u0647\u0627\u06cc \u062a\u0646\u0638\u06cc\u0645 \u0634\u062f\u0647 \u0627\u0644\u0627\u0646 \u0631\u0627 \u0628\u0628\u06cc\u0646\u06cc\u0645 : <\/p>\n\n\n\n

splunk.exe list forward-server<\/code><\/p>\n\n\n\n

Splunk username: \u0646\u0627\u0645 \u06a9\u0627\u0631\u0628\u0631\u06cc \u06a9\u0647 \u0627\u0639\u0644\u0627\u0645 \u06a9\u0631\u062f\u06cc\u0645 \u0645\u0648\u0642\u0639 \u0627\u0633\u062a\u0627\u0631\u062a
Password: \u067e\u0633\u0648\u0631\u062f \u0627\u0639\u0644\u0627\u0645 \u0634\u062f\u0647
Active forwards:
172.22.22.25:9997
Configured but inactive forwards:
None<\/code><\/p>\n\n\n\n

\u0645\u06cc \u062a\u0648\u0627\u0646\u06cc\u0645 \u0644\u0627\u06af \u0645\u0631\u0628\u0648\u0637 \u0628\u0647 \u0627\u0633\u067e\u0644\u0627\u0646\u06a9 \u0647\u0645 \u062f\u0631 \u0645\u0633\u06cc\u0631 \u0632\u06cc\u0631 \u0628\u0628\u06cc\u0646\u06cc\u0645 : <\/p>\n\n\n\n

$SPLUNK_HOMW\/var\/log\/splunk\/splunkd.log<\/code><\/p>\n\n\n\n

\u0648 \u0628\u06af\u0631\u062f\u06cc\u0645 \u062f\u0646\u0628\u0627\u0644 \u0647\u0631 \u06af\u0648\u0646\u0647 ERROR<\/code> \u062f\u0631 \u0644\u0627\u06af \u0647\u0627\u06cc \u062f\u06cc\u062f\u0647 \u0634\u062f\u0647. <\/bdo><\/p>\n\n\n\n

\u0645\u06cc \u062a\u0648\u0627\u0646\u06cc\u0645 Deployment<\/code> \u0645\u0631\u06a9\u0632\u06cc \u062f\u0627\u0634\u062a\u0647 \u0628\u0627\u0634\u06cc\u0645 \u0648 \u0628\u0631\u0627\u06cc \u0627\u06cc\u0646 \u06a9\u0627\u0631 \u0646\u06cc\u0627\u0632 \u0627\u0633\u062a \u06a9\u0647 \u0641\u0627\u06cc\u0644 <\/bdo><\/p>\n\n\n\n

deploymentclient.conf<\/code><\/p>\n\n\n\n

\u0631\u0627 \u06cc\u0627 \u0637\u0631\u06cc\u0642 \u0648\u06cc\u0631\u0627\u06cc\u0634\u06af\u0631 \u06cc\u0627 \u0627\u0632 \u0637\u0631\u06cc\u0642 \u062f\u0633\u062a\u0648\u0631\u0627\u062a \u0627\u062c\u0631\u0627 \u0646\u0645\u0627\u06cc\u06cc\u0645. \u062f\u0633\u062a\u0648\u0631 \u0632\u06cc\u0631 \u0631\u0627 \u0627\u062c\u0631\u0627 \u0645\u06cc \u06a9\u0646\u06cc\u0645 :<\/bdo><\/p>\n\n\n\n

.\/splunk set deploy-poll <ds-host:port><\/code><\/p>\n\n\n\n

\u0627\u06af\u0631 \u062f\u0633\u062a\u0648\u0631\u0627\u062a \u0628\u0647 \u062f\u0631\u0633\u062a\u06cc \u06a9\u0627\u0631 \u06a9\u0646\u0646\u062f \u0628\u0627\u06cc\u062f \u062f\u0631 \u0645\u0633\u06cc\u0631 \u0632\u06cc\u0631 \u0641\u0627\u06cc\u0644 \u0633\u0627\u062e\u062a\u0647 \u0634\u062f\u0647 \u0648 \u062a\u0646\u0638\u06cc\u0645\u0627\u062a \u062f\u0631\u0648\u0646 \u0622\u0646 \u0627\u0639\u0645\u0627\u0644 \u0634\u062f\u0647 \u0628\u0627\u0634\u062f. <\/bdo><\/p>\n\n\n\n

$SPLUNK-HOMW\/etc\/system\/local\/deploymentclient.conf<\/code><\/p>\n\n\n\n

\u0647\u0631 \u0641\u0648\u0631\u0648\u0627\u0631\u062f\u0631 \u0647\u0631 \u06f6\u06f0<\/code> \u062b\u0627\u0646\u06cc\u0647 \u0628\u0647 \u0633\u0631\u0648\u0631 \u0645\u062a\u0635\u0644 \u0645\u06cc \u0634\u0648\u062f. \u0628\u0631\u0627\u06cc \u062a\u063a\u06cc\u06cc\u0631\u0627\u062a \u0627\u06cc\u0646 \u0645\u0648\u0636\u0648\u0639 \u0645\u06cc \u0628\u0627\u06cc\u062f \u062f\u0631 \u0641\u0627\u06cc\u0644 \u062a\u063a\u06cc\u06cc\u0631\u0627\u062a \u0631\u0627 \u0628\u062f\u0647\u06cc\u0645. <\/bdo><\/p>\n\n\n\n

\u0627\u06af\u0631 \u0641\u0627\u06cc\u0644 \u0631\u0627 \u062a\u063a\u06cc\u06cc\u0631 \u062f\u0647\u06cc\u0645 \u0628\u0631\u0627\u06cc \u0627\u062c\u0631\u0627\u06cc \u0627\u0646\u0647\u0627\u06cc \u0628\u0627\u06cc\u062f \u0627\u0633\u067e\u0644\u0627\u0646\u06a9 \u0631\u06cc\u0633\u062a\u0627\u0631\u062a \u0634\u0648\u062f. <\/bdo><\/p>\n\n\n\n

\u0628\u0631\u0627\u06cc \u062f\u06cc\u062f\u0646 \u0627\u0631\u062a\u0628\u0627\u0637 \u0628\u0627 DS<\/code> \u062f\u0633\u062a\u0648\u0631 \u0632\u06cc\u0631 \u0631\u0627 \u0645\u06cc \u0632\u0646\u06cc\u0645 : <\/bdo><\/p>\n\n\n\n

\/.splunk show deploy-poll<\/code><\/p>\n\n\n\n

\u0648 \u0647\u0645\u0686\u0646\u06cc\u0646 \u0647\u0645\u0627\u0646 \u0641\u0627\u06cc\u0644 \u0644\u0627\u06af \u0627\u0635\u0644\u06cc \u0631\u0627 \u0645\u06cc \u062a\u0648\u0627\u0646\u06cc\u0645 \u0628\u0631\u0627\u06cc \u062f\u06cc\u062f\u0646 \u062e\u0637\u0627 \u0628\u0631\u0631\u0633\u06cc \u06a9\u0646\u06cc\u0645. <\/bdo><\/p>\n\n\n\n

<\/p>\n\n\n\n

<\/p>\n","protected":false},"excerpt":{"rendered":"

\u0628\u0639\u062f \u0627\u0632 \u0646\u0635\u0628 UF \u0631\u0648\u06cc \u0648\u06cc\u0646\u062f\u0648\u0632 \u0645\u06cc \u062a\u0648\u0627\u0646 \u0648\u0627\u0631\u062f \u0645\u0633\u06cc\u0631 \u0632\u06cc\u0631 \u0634\u062f \u0648 \u062f\u0633\u062a\u0648\u0631 \u0632\u06cc\u0631 \u0631\u0627 \u062a\u0627\u06cc\u067e \u06a9\u0631\u062f \u062a\u0627 \u0628\u0628\u06cc\u0646\u06cc\u0645 \u0622\u06cc\u0627 \u0633\u0631\u0648\u06cc\u0633 \u062f\u0631 \u062d\u0627\u0644 \u0627\u062c\u0631 cd C:\\Program Files\\SplunkUniversalForwarder\\bin>splunk.exe status \u062f\u0631 \u0644\u06cc\u0646\u0648\u06a9\u0633 \u0645\u0633\u06cc\u0631 \u067e\u06cc\u0634\u0641\u0631\u0636 \u0628\u0631\u0627\u06cc \u0646\u0635\u0628 \u0627\u0633\u067e\u0644\u0627\u0646\u06a9 \u062f\u0631 \u0645\u0633\u06cc\u0631 \u0632\u06cc\u0631 \u0645\u06cc \u0628\u0627\u0634\u062f : \/opt\/splunkforwarder dpkg -I splunk***.deb dpkg xvfz splunk***.tgz \/optcd \/opt\/splunkforwarder\/bin .\/splunk start -accept-license \u0628\u0639\u062f […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","template":"","knowledgebase_cat":[18],"class_list":["post-196","knowledgebase","type-knowledgebase","status-publish","hentry","knowledgebase_cat-splunk"],"_links":{"self":[{"href":"https:\/\/securitylearning.ir\/index.php\/wp-json\/wp\/v2\/knowledgebase\/196","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/securitylearning.ir\/index.php\/wp-json\/wp\/v2\/knowledgebase"}],"about":[{"href":"https:\/\/securitylearning.ir\/index.php\/wp-json\/wp\/v2\/types\/knowledgebase"}],"author":[{"embeddable":true,"href":"https:\/\/securitylearning.ir\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/securitylearning.ir\/index.php\/wp-json\/wp\/v2\/comments?post=196"}],"version-history":[{"count":10,"href":"https:\/\/securitylearning.ir\/index.php\/wp-json\/wp\/v2\/knowledgebase\/196\/revisions"}],"predecessor-version":[{"id":214,"href":"https:\/\/securitylearning.ir\/index.php\/wp-json\/wp\/v2\/knowledgebase\/196\/revisions\/214"}],"wp:attachment":[{"href":"https:\/\/securitylearning.ir\/index.php\/wp-json\/wp\/v2\/media?parent=196"}],"wp:term":[{"taxonomy":"knowledgebase_cat","embeddable":true,"href":"https:\/\/securitylearning.ir\/index.php\/wp-json\/wp\/v2\/knowledgebase_cat?post=196"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}