https://community.splunk.com/t5/Getting-Data-In/How-do-I-forward-to-a-vm-and-forward-it-out-again/m-p/327746#M60848 <P>not sure how Deployment Server comes to play here.<BR /> Deployment Server controls the forwarders (and other splunk instances if desired) configurations<BR /> i think the only thing you need is to verify there is a connection between all 3 machines guest1, guest2, and PC.<BR /> have a forwarder collect sysmon and forward it to guest2, have guest2 listen to TCP inputs and forward out using TCP to PC. <BR /> have the PC listen to traffic from guest2 on the desired port and you are all set<BR /> hope i understand the question and i am not missing something here.</P> Sun, 23 Jul 2017 16:27:50 GMT adonio 2017-07-23T16:27:50Z https://community.splunk.com/t5/Getting-Data-In/How-do-I-forward-to-a-vm-and-forward-it-out-again/m-p/327745#M60847 <P>Hi,</P> <P>how does one forward something like sysmon from 1 vm (guest1) to another vm (guest2) and then out to another pc (outside network)? </P> <P>Do I install universal forwarder and sysmon on Guest 1, and use deployment server to send out to another PC outside network? </P> Sun, 23 Jul 2017 03:32:00 GMT https://community.splunk.com/t5/Getting-Data-In/How-do-I-forward-to-a-vm-and-forward-it-out-again/m-p/327745#M60847 wuming79 2017-07-23T03:32:00Z https://community.splunk.com/t5/Getting-Data-In/How-do-I-forward-to-a-vm-and-forward-it-out-again/m-p/327746#M60848 <P>not sure how Deployment Server comes to play here.<BR /> Deployment Server controls the forwarders (and other splunk instances if desired) configurations<BR /> i think the only thing you need is to verify there is a connection between all 3 machines guest1, guest2, and PC.<BR /> have a forwarder collect sysmon and forward it to guest2, have guest2 listen to TCP inputs and forward out using TCP to PC. <BR /> have the PC listen to traffic from guest2 on the desired port and you are all set<BR /> hope i understand the question and i am not missing something here.</P> Sun, 23 Jul 2017 16:27:50 GMT https://community.splunk.com/t5/Getting-Data-In/How-do-I-forward-to-a-vm-and-forward-it-out-again/m-p/327746#M60848 adonio 2017-07-23T16:27:50Z https://community.splunk.com/t5/Getting-Data-In/How-do-I-forward-to-a-vm-and-forward-it-out-again/m-p/327747#M60849 <P>Hi, thanks adonio, I realized I only need to setup forwarder twice on both guest machines. No need for deployment server. </P> Mon, 24 Jul 2017 01:34:18 GMT https://community.splunk.com/t5/Getting-Data-In/How-do-I-forward-to-a-vm-and-forward-it-out-again/m-p/327747#M60849 wuming79 2017-07-24T01:34:18Z https://community.splunk.com/t5/Getting-Data-In/How-do-I-forward-to-a-vm-and-forward-it-out-again/m-p/327748#M60850 <P>I made a mistake installing sysmon on both my guest machines and forwarding sysmon log from guest 1 (Host-only) to guest2 (Host-only and natNetwork) and intermediately forward out to another host. I thought I was looking at the sysmon log from guest 1 but realized I'm not.<BR /><BR /> How should I set up the input.conf and output.conf on guest2??</P> Mon, 24 Jul 2017 03:25:38 GMT https://community.splunk.com/t5/Getting-Data-In/How-do-I-forward-to-a-vm-and-forward-it-out-again/m-p/327748#M60850 wuming79 2017-07-24T03:25:38Z https://community.splunk.com/t5/Getting-Data-In/How-do-I-forward-to-a-vm-and-forward-it-out-again/m-p/327749#M60851 <P>Is a vmware host-only guest able to forward out data to host??</P> Mon, 24 Jul 2017 14:15:46 GMT https://community.splunk.com/t5/Getting-Data-In/How-do-I-forward-to-a-vm-and-forward-it-out-again/m-p/327749#M60851 wuming79 2017-07-24T14:15:46Z