topic Intermediate forwarder not forwarding _internal data in Getting Data In

Intermediate forwarder not forwarding _internal data

mohankesireddy — Thu, 19 Dec 2013 20:00:36 GMT

I am using Universal Forwarder as Intermediate forwarder, it is forwarding the monitored data without any issues but it is not forwarding any data _internal index or Splunk logs.

Intermediate Forwarder Configuration:
Outputs.conf
[tcpout:index]
server=sra-index-01:9997,sra-index-02:9997,sra-index-03:9997,sra-index-04:9997,sra-index-05:9997

inputs.conf
[splunktcp://9997]
disabled=0

Re: Intermediate forwarder not forwarding _internal data

dmaislin_splunk — Thu, 19 Dec 2013 20:09:57 GMT

[tcpout]
forwardedindex.filter.disable = true

Re: Intermediate forwarder not forwarding _internal data

mohankesireddy — Thu, 19 Dec 2013 20:41:14 GMT

Thanks dmaislin, it worked.

Re: Intermediate forwarder not forwarding _internal data

archspangler — Thu, 04 Aug 2016 21:21:01 GMT

Worked for me as well.