topic can a universal forwarder serve as a relay between another forwarder and the indexer? in Getting Data In

can a universal forwarder serve as a relay between another forwarder and the indexer?

matt — Fri, 06 May 2011 17:26:16 GMT

Can I have a universal forwarder collect data from other universal forwarders and then send that off to the indexer?

Re: can a universal forwarder serve as a relay between another forwarder and the indexer?

Steve_G_ — Fri, 06 May 2011 17:28:45 GMT

Yes, you can.

Re: can a universal forwarder serve as a relay between another forwarder and the indexer?

Steve_G_ — Fri, 06 May 2011 17:30:10 GMT

Here's a chart with the capabilities of all the types of forwarders:

http://www.splunk.com/base/Documentation/latest/Deploy/Typesofforwarders#Forwarder_comparison

Re: can a universal forwarder serve as a relay between another forwarder and the indexer?

jbsplunk — Mon, 09 May 2011 15:53:23 GMT

So, it will work as an relay for things like syslog, and probably for very simple file monitoring use cases similar to syslog type configurations. It is not intended to work for Splunk2Splunk communication, and you will run into problems with attempting this type of a configuration. Thanks to Steve in Splunk doc's for dropping me an email with the clarifications.

Re: can a universal forwarder serve as a relay between another forwarder and the indexer?

asingla — Mon, 17 Oct 2011 21:01:13 GMT

Hi Steve G,

I am confused by the answer. Do you mean the below topology will not work? I have the latest version 4.2.3.

Program -> Universal forwarder -> Universal Forwarder (Intermediate) -> Main Indexer

'->' the flow of TCP message originated from the Program.

The table says 'Yes' against 'Serves as intermediate forwarder?' for Universal Forwarder.

I am asking this as this setup is not working for me right now. I am not sure if I didn't configure it properly or it does not work.

Re: can a universal forwarder serve as a relay between another forwarder and the indexer?

Steve_G_ — Mon, 17 Oct 2011 21:12:18 GMT

There was some controversy about this a while ago, so pardon the confusion, but, yes, that topology should work.

If you're running into issues getting it to work, I suggest you pose a new question in Answers, with the specifics of your configuration.

Re: can a universal forwarder serve as a relay between another forwarder and the indexer?

asingla — Tue, 18 Oct 2011 17:09:04 GMT

Here is my question

http://splunk-base.splunk.com/answers/32446/universal-forwarder-is-not-working-as-an-intermdiate-forwarder