https://community.splunk.com/t5/Getting-Data-In/universal-forwarder/m-p/21788#M3295 <P>Yes, in normal circumstances really no need to do this since the indexer can directly do everything the UF can do. However, this can be useful for testing purposes, or for some more complex load-balancing or failover purposes.</P> Sun, 08 Apr 2012 16:22:24 GMT gkanapathy 2012-04-08T16:22:24Z https://community.splunk.com/t5/Getting-Data-In/universal-forwarder/m-p/21786#M3293 <P>hello</P> <P>can we install the splunk instance as an indexer and universal forwarder in the same machine and try to forward data beteween them </P> Sun, 08 Apr 2012 08:54:09 GMT https://community.splunk.com/t5/Getting-Data-In/universal-forwarder/m-p/21786#M3293 sarah89 2012-04-08T08:54:09Z https://community.splunk.com/t5/Getting-Data-In/universal-forwarder/m-p/21787#M3294 <P>why would you want to do that as an indexer can collect data directly too (and even forward data to another indexer or 3rd party ie:syslog-ng)?</P> <P>If you still want to do that you will need to change splunkd listening port 8089 on one of them.</P> Sun, 08 Apr 2012 09:25:17 GMT https://community.splunk.com/t5/Getting-Data-In/universal-forwarder/m-p/21787#M3294 MarioM 2012-04-08T09:25:17Z https://community.splunk.com/t5/Getting-Data-In/universal-forwarder/m-p/21788#M3295 <P>Yes, in normal circumstances really no need to do this since the indexer can directly do everything the UF can do. However, this can be useful for testing purposes, or for some more complex load-balancing or failover purposes.</P> Sun, 08 Apr 2012 16:22:24 GMT https://community.splunk.com/t5/Getting-Data-In/universal-forwarder/m-p/21788#M3295 gkanapathy 2012-04-08T16:22:24Z