https://community.splunk.com/t5/Splunk-Enterprise/How-to-store-log-to-Splunk-Enterprise-Server-with-Forwarded/m-p/425583#M7949 <P>Forwarded inputs means data coming from Universal forwarder or Heavy Forwarder to Indexer.</P> <P>if it so, then we can save data on that machine only i.e Indexer.</P> Wed, 23 Jan 2019 13:39:41 GMT vishaltaneja070 2019-01-23T13:39:41Z