Skip to content

Where Them
Logs AppWTLA-01

Splunk Universal Forwarder

1 log location · Windows

Cisco Systems, Inc. · Vendor documentation (opens in a new tab)

Where Splunk Universal Forwarder keeps its logs

Splunk Universal Forwarder logs to %PROGRAMFILES%\SplunkUniversalForwarder\var\log\splunk\splunkd.log on Windows.

Paths are printed exactly as Splunk Universal Forwarder writes them. Environment variables like %LOCALAPPDATA% and $XDG_STATE_HOME are never expanded, so a path can be pasted straight into a shell. Where a path differs between installer types or shipping flavours, each one is racked as its own card below - why that happens.

WIN

Splunk Universal Forwarder - Windows

Cisco Systems, Inc.

Forwarder log

%PROGRAMFILES%\SplunkUniversalForwarder\var\log\splunk\splunkd.log- $SPLUNK_HOME\var\log\splunk\ when installed elsewhere.

Wrong path? Add a variant