https://community.splunk.com/t5/Getting-Data-In/Restrict-Indexer-to-receive-data-from-a-forwarder/m-p/81961#M16921 <P>Hi,</P> <P>I have configured an indexer to receive data from universal forwarder. Is it possible to specify a list of forwarders in the indexer such that the indexer will recieve data only from the forwarders specified in the list?</P> Fri, 22 Jun 2012 16:09:41 GMT parth_jec 2012-06-22T16:09:41Z https://community.splunk.com/t5/Getting-Data-In/Restrict-Indexer-to-receive-data-from-a-forwarder/m-p/81961#M16921 <P>Hi,</P> <P>I have configured an indexer to receive data from universal forwarder. Is it possible to specify a list of forwarders in the indexer such that the indexer will recieve data only from the forwarders specified in the list?</P> Fri, 22 Jun 2012 16:09:41 GMT https://community.splunk.com/t5/Getting-Data-In/Restrict-Indexer-to-receive-data-from-a-forwarder/m-p/81961#M16921 parth_jec 2012-06-22T16:09:41Z https://community.splunk.com/t5/Getting-Data-In/Restrict-Indexer-to-receive-data-from-a-forwarder/m-p/81962#M16922 <P>Yes, in inputs.conf on the indexer:</P> <P>Instead of </P> <PRE><CODE>[splunktcp://:9997] </CODE></PRE> <P>Use one stanza for each host, like this</P> <PRE><CODE>[splunktcp://host1.mycompany.com:9996] [splunktcp://host2.mycompany.com:9996] [splunktcp://host3.mycompany.com:9996] </CODE></PRE> Fri, 22 Jun 2012 18:20:28 GMT https://community.splunk.com/t5/Getting-Data-In/Restrict-Indexer-to-receive-data-from-a-forwarder/m-p/81962#M16922 lguinn2 2012-06-22T18:20:28Z https://community.splunk.com/t5/Getting-Data-In/Restrict-Indexer-to-receive-data-from-a-forwarder/m-p/81963#M16923 <P>It worked! but first I had to disable the 9997 port from listening.</P> <P>Thanks </P> Fri, 22 Jun 2012 22:12:21 GMT https://community.splunk.com/t5/Getting-Data-In/Restrict-Indexer-to-receive-data-from-a-forwarder/m-p/81963#M16923 parth_jec 2012-06-22T22:12:21Z