I have a UF installed on syslog server and now I want the data to come to HF and not to go to UF. I just need the syslog data to be completely redirected to HF from UF. What are the config changes that I need to do?
let me understand: are you asking help on how to configure the syslog source or what else?
If this is your need, it depends on the the source appliance: you have to go in the management interface and change the syslog destination IP.
Obviously, remember to configure the HF to receive syslogs on a predefined port and protocol.
sorry, but there's something that I don't understand:
Is it correct?
It's not clear for me when you say: "splunk indexer which is the UF", Indexer and UF usually are two different systems!
Anyway, if you want to receive syslogs on the HF instead of the UF, you have to do the following steps: