topic Forwarding Data From on Universal Forwarder to Another Universal Forwarder in Getting Data In https://community.splunk.com/t5/Getting-Data-In/Forwarding-Data-From-on-Universal-Forwarder-to-Another-Universal/m-p/73637#M15095 <P>Is it possible to forward the data from one Universal Forwarder to another Universal Forwarder ? If so can you please direct me to the appropriate documentation. </P> Thu, 27 Sep 2012 21:29:46 GMT ssankeneni 2012-09-27T21:29:46Z Forwarding Data From on Universal Forwarder to Another Universal Forwarder https://community.splunk.com/t5/Getting-Data-In/Forwarding-Data-From-on-Universal-Forwarder-to-Another-Universal/m-p/73637#M15095 <P>Is it possible to forward the data from one Universal Forwarder to another Universal Forwarder ? If so can you please direct me to the appropriate documentation. </P> Thu, 27 Sep 2012 21:29:46 GMT https://community.splunk.com/t5/Getting-Data-In/Forwarding-Data-From-on-Universal-Forwarder-to-Another-Universal/m-p/73637#M15095 ssankeneni 2012-09-27T21:29:46Z Re: Forwarding Data From on Universal Forwarder to Another Universal Forwarder https://community.splunk.com/t5/Getting-Data-In/Forwarding-Data-From-on-Universal-Forwarder-to-Another-Universal/m-p/73638#M15096 <P>Yes. Simply configure a tcpout stanza in the outputs.conf of the first Forwarder to forward to Intermediary Forwarder:</P> <PRE><CODE>[tcpout] defaultGroup=intermediaryForwarder [intermediaryForwarder] server=myintermediaryforwarder.company.com:9997 </CODE></PRE> <P>Then, configure a splunktcp stanza in the inputs.conf of the Intermediary Forwarder:</P> <PRE><CODE>[splunktcp://:9997] </CODE></PRE> <P>...as well as a another tcpout in the Intermediary Forwarder to forward to Indexers:</P> <PRE><CODE>[tcpout] defaultGroup=indexers [indexers] server=myindexer:9997 </CODE></PRE> Fri, 28 Sep 2012 11:45:50 GMT https://community.splunk.com/t5/Getting-Data-In/Forwarding-Data-From-on-Universal-Forwarder-to-Another-Universal/m-p/73638#M15096 ayme 2012-09-28T11:45:50Z Re: Forwarding Data From on Universal Forwarder to Another Universal Forwarder https://community.splunk.com/t5/Getting-Data-In/Forwarding-Data-From-on-Universal-Forwarder-to-Another-Universal/m-p/73639#M15097 <P>Thank you very much</P> Mon, 01 Oct 2012 18:16:13 GMT https://community.splunk.com/t5/Getting-Data-In/Forwarding-Data-From-on-Universal-Forwarder-to-Another-Universal/m-p/73639#M15097 ssankeneni 2012-10-01T18:16:13Z