https://community.splunk.com/t5/Getting-Data-In/Is-there-a-sample-configuration-available-for-intermediate/m-p/204972#M40472 <P>See this (old post but you can refer to latest documentation for each step)</P> <P><A href="https://answers.splunk.com/answers/10429/is-there-an-example-configuration-available-for-an-intermediate-forwarding-configuration.html">https://answers.splunk.com/answers/10429/is-there-an-example-configuration-available-for-an-intermediate-forwarding-configuration.html</A></P> <P>Basically</P> <P>Setup Forwarding on Universal forwarder (installed on your application servers) - (should forward to your Intermediate forwarder) <A href="http://docs.splunk.com/Documentation/Splunk/6.4.3/Forwarding/EnableforwardingonaSplunkEnterpriseinstance">http://docs.splunk.com/Documentation/Splunk/6.4.3/Forwarding/EnableforwardingonaSplunkEnterpriseinstance</A><BR /> Setup Receiving and Forwarding on Intermediate forwarder : (should forwarder to Indexers) <A href="http://docs.splunk.com/Documentation/Splunk/6.4.3/Forwarding/Configureanintermediateforwarder">http://docs.splunk.com/Documentation/Splunk/6.4.3/Forwarding/Configureanintermediateforwarder</A><BR /> Setup Receiving on Indexer: <A href="http://docs.splunk.com/Documentation/Forwarder/6.4.3/Forwarder/Enableareceiver">http://docs.splunk.com/Documentation/Forwarder/6.4.3/Forwarder/Enableareceiver</A></P> Wed, 21 Sep 2016 16:37:59 GMT somesoni2 2016-09-21T16:37:59Z https://community.splunk.com/t5/Getting-Data-In/Is-there-a-sample-configuration-available-for-intermediate/m-p/204971#M40471 <P>In my use case, I need to forward logs from application servers to intermediate forwarders, then from the intermediate forwarder to Splunk Indexers. Can anybody help me in providing a sample configuration file for this?</P> Wed, 21 Sep 2016 15:17:31 GMT https://community.splunk.com/t5/Getting-Data-In/Is-there-a-sample-configuration-available-for-intermediate/m-p/204971#M40471 sravankaripe 2016-09-21T15:17:31Z https://community.splunk.com/t5/Getting-Data-In/Is-there-a-sample-configuration-available-for-intermediate/m-p/204972#M40472 <P>See this (old post but you can refer to latest documentation for each step)</P> <P><A href="https://answers.splunk.com/answers/10429/is-there-an-example-configuration-available-for-an-intermediate-forwarding-configuration.html">https://answers.splunk.com/answers/10429/is-there-an-example-configuration-available-for-an-intermediate-forwarding-configuration.html</A></P> <P>Basically</P> <P>Setup Forwarding on Universal forwarder (installed on your application servers) - (should forward to your Intermediate forwarder) <A href="http://docs.splunk.com/Documentation/Splunk/6.4.3/Forwarding/EnableforwardingonaSplunkEnterpriseinstance">http://docs.splunk.com/Documentation/Splunk/6.4.3/Forwarding/EnableforwardingonaSplunkEnterpriseinstance</A><BR /> Setup Receiving and Forwarding on Intermediate forwarder : (should forwarder to Indexers) <A href="http://docs.splunk.com/Documentation/Splunk/6.4.3/Forwarding/Configureanintermediateforwarder">http://docs.splunk.com/Documentation/Splunk/6.4.3/Forwarding/Configureanintermediateforwarder</A><BR /> Setup Receiving on Indexer: <A href="http://docs.splunk.com/Documentation/Forwarder/6.4.3/Forwarder/Enableareceiver">http://docs.splunk.com/Documentation/Forwarder/6.4.3/Forwarder/Enableareceiver</A></P> Wed, 21 Sep 2016 16:37:59 GMT https://community.splunk.com/t5/Getting-Data-In/Is-there-a-sample-configuration-available-for-intermediate/m-p/204972#M40472 somesoni2 2016-09-21T16:37:59Z