topic Heavy forwarder - Syslog forwarder in Getting Data In

Heavy forwarder - Syslog forwarder

zidekm — Tue, 03 Feb 2015 10:01:49 GMT

Hi,

it is possible to configure HWF just to receive and forward syslog without indexing data?

If i do configuration like this and HWF is not configured to forward data into Indexers splunk, HWF splunk instance start indexing data and use data license.

Sebastian

inputs.conf

[default]
host = splunkfwd

[udp://192.168.130.100:2514]
_SYSLOG_ROUTING = syslog-data

outputs.conf

[syslog]
defaultGroup = syslog-data

[syslog:syslog-data]
server = 192.168.130.200:514
type = udp

Re: Heavy forwarder - Syslog forwarder

thomrs — Thu, 05 Feb 2015 18:28:06 GMT

Yes this is doable, set up forwarding on your HF.

/en-US/manager/wx/forwardreceive

and all data will go to your indexer. This can also be set via a splunk cmd as well.

Re: Heavy forwarder - Syslog forwarder

zidekm — Thu, 05 Feb 2015 20:29:32 GMT

I don't want to send data to indexer, i just want forward syslog message to another splunk due to firewall limitation i cannot use TCP connection.