https://community.splunk.com/t5/Alerting/Splunk-heavy-forwarder/m-p/55544#M766 <P>Yes, you need a heavy forwarder, but if you mean from you main splunk instance, then you don't need to install it because the main splunk instance is a heavy forwarder.</P> Thu, 05 Sep 2013 16:21:32 GMT lukejadamec 2013-09-05T16:21:32Z https://community.splunk.com/t5/Alerting/Splunk-heavy-forwarder/m-p/55543#M765 <P>Hi,</P> <P>I'm new to Splunk and I'd like to forward data from Splunk to an external server upon event occurrence. <BR /> From what I read so far, a heavy forwarder should be used to do so since it's the only forwarder that supports alert. Am I in the right direction?</P> <P>Thanks!<BR /> Tony</P> Thu, 05 Sep 2013 16:12:59 GMT https://community.splunk.com/t5/Alerting/Splunk-heavy-forwarder/m-p/55543#M765 tonyArad 2013-09-05T16:12:59Z https://community.splunk.com/t5/Alerting/Splunk-heavy-forwarder/m-p/55544#M766 <P>Yes, you need a heavy forwarder, but if you mean from you main splunk instance, then you don't need to install it because the main splunk instance is a heavy forwarder.</P> Thu, 05 Sep 2013 16:21:32 GMT https://community.splunk.com/t5/Alerting/Splunk-heavy-forwarder/m-p/55544#M766 lukejadamec 2013-09-05T16:21:32Z