topic Re: Multisite Heavy forwarder connectivity to multisite UF in Splunk Enterprise

Multisite Heavy forwarder connectivity to multisite UF- How do I need to set up the connection?

BT — Tue, 19 Apr 2022 16:54:20 GMT

Hi Team,

Could you please clarify my doubt on connectivity between Heavy forwarder and Universal Forwarder. I have 2 site, Heavy forwarder and universal forwarder on both site. Do I need to connect the heavy forwarder on X site to universal forwarder on X site only or do I need to connect HF on X site to both X and Y site UFs.

There will be connectivity between both sites. Heavy forwarder are not connected to each other. they will be pushing data to indexers which are clustered.

Re: Multisite Heavy forwarder connectivity to multisite UF

SinghK — Mon, 18 Apr 2022 06:32:19 GMT

Well the first question is why are you connecting UF to hf is there a specific requirement as UF can connect directly to indexers or cluster.

Re: Multisite Heavy forwarder connectivity to multisite UF

BT — Mon, 18 Apr 2022 06:35:11 GMT

Hi,

I want is to configure universal forwarder to send logs/data to heavy forwarders and do some filtering there, and then forward the logs to indexers from heavy weight forwarders.

Re: Multisite Heavy forwarder connectivity to multisite UF

SinghK — Mon, 18 Apr 2022 06:38:34 GMT

Then create a normal output.conf on uf and point it to hf and on hf create input similar to indexers

[Splunktcp://: port ]

Rest of your input config

And hf is already connected to indexers so it should start sending data.

Use props on hf to filter data and a should be set.

Re: Multisite Heavy forwarder connectivity to multisite UF

SinghK — Mon, 18 Apr 2022 06:41:08 GMT

for more info check this post out

https://community.splunk.com/t5/Getting-Data-In/How-to-forward-logs-from-universal-forwarders-to-heavy/m-p/251645

Re: Multisite Heavy forwarder connectivity to multisite UF

BT — Mon, 18 Apr 2022 06:51:10 GMT

Then create a normal output.conf on uf and point it to hf ---- both sites HF ?

Re: Multisite Heavy forwarder connectivity to multisite UF

SinghK — Mon, 18 Apr 2022 06:53:10 GMT

x to x and y to y

Re: Multisite Heavy forwarder connectivity to multisite UF

PickleRick — Mon, 18 Apr 2022 16:38:21 GMT

It depends on your circumstances and needs. Using only local HFs can be desired if you have severely limited bandwidth between sites or some data security limitation. Using all HFs on the other hand removes SPOF and allows for better workload distribution.

So there is no sigle optimal solution for all possible cases