https://community.splunk.com/t5/Getting-Data-In/Universal-Forwarder/m-p/172664#M34751 <P>You can chain Universal Forwarders (UF) to Universal forwarders, or chain UF to heavy forwarders (HF), then forward to indexers. The method will be to open a splunktcp listening port on the intermediary servers.</P> <P>see <A href="http://docs.splunk.com/Documentation/Splunk/6.0.2/Forwarding/Forwarderdeploymenttopologies#Intermediate_forwarding">http://docs.splunk.com/Documentation/Splunk/6.0.2/Forwarding/Forwarderdeploymenttopologies#Intermediate_forwarding</A><BR /> and<BR /> <A href="http://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Setupforwardingandreceiving">http://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Setupforwardingandreceiving</A></P> <P>Remarks :</P> <UL> <LI>Using a heavy forwarder will be to process the events at one point ( to filter, parse, redirect with rules, using ssl forwarding for unsecure networks ...)</LI> <LI>If you are using a forwarder to concentrate, you may want to check the "thruput" limit to avoid bottleneck.</LI> </UL> <P>example :<BR /> UF -&gt; IDX<BR /> UF -&gt; UF -&gt; IDX<BR /> UF -&gt; HF -&gt; IDX</P> Mon, 03 Mar 2014 23:59:30 GMT yannK 2014-03-03T23:59:30Z https://community.splunk.com/t5/Getting-Data-In/Universal-Forwarder/m-p/172663#M34750 <P>Hi, I have a scenario where i need to deploy a forwarder to collect data from a Zone which may not be allowed to reach directly to zone where my indexers are, i have been looking for a bridge to get my forwarded data to indexers.<BR /> Q: i was reading a Universal forwarder can forward the data from One Universal Forwarder to Another? does it work well?<BR /> If yes it is recommended? or any other option?<BR /> Q. If answer to both is yes do they talk on port 9997? any reference to doc?</P> Mon, 03 Mar 2014 23:29:32 GMT https://community.splunk.com/t5/Getting-Data-In/Universal-Forwarder/m-p/172663#M34750 nikhilmehra79 2014-03-03T23:29:32Z https://community.splunk.com/t5/Getting-Data-In/Universal-Forwarder/m-p/172664#M34751 <P>You can chain Universal Forwarders (UF) to Universal forwarders, or chain UF to heavy forwarders (HF), then forward to indexers. The method will be to open a splunktcp listening port on the intermediary servers.</P> <P>see <A href="http://docs.splunk.com/Documentation/Splunk/6.0.2/Forwarding/Forwarderdeploymenttopologies#Intermediate_forwarding">http://docs.splunk.com/Documentation/Splunk/6.0.2/Forwarding/Forwarderdeploymenttopologies#Intermediate_forwarding</A><BR /> and<BR /> <A href="http://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Setupforwardingandreceiving">http://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Setupforwardingandreceiving</A></P> <P>Remarks :</P> <UL> <LI>Using a heavy forwarder will be to process the events at one point ( to filter, parse, redirect with rules, using ssl forwarding for unsecure networks ...)</LI> <LI>If you are using a forwarder to concentrate, you may want to check the "thruput" limit to avoid bottleneck.</LI> </UL> <P>example :<BR /> UF -&gt; IDX<BR /> UF -&gt; UF -&gt; IDX<BR /> UF -&gt; HF -&gt; IDX</P> Mon, 03 Mar 2014 23:59:30 GMT https://community.splunk.com/t5/Getting-Data-In/Universal-Forwarder/m-p/172664#M34751 yannK 2014-03-03T23:59:30Z