Is it possible to have cascading forwarders to connect our Windows server to the Splunk App for Windows Infrastructure without direct connection to the indexer?

[mkuhlmann]

Hi, I plan to connect windows Server to the Infrastructure APP and have some network design restrictions.

Due to the infrastructure deployment it would be helpful to cascade universal forwarder with heavy forwarders. The heavy forwarders are directly in front of the Indexer Cluster.

Is this generally possible and how could this configured or are there some functional restrictions?

The use case is to connect Windows Server to the Windows infrastructure APP without direct connection to the indexer.

Splunk Version 6.1

Many thanks in advanced

[tom_frotscher]

Hi,

i think what you are looking for is called "Intermediate Forwarding" in the splunk world. Look at this little section in the docs: link

There is not much documentation for this setup, but there are already some questions regarding this. For example:

http://answers.splunk.com/answers/10429/is-there-an-example-configuration-available-for-an-intermedi...

http://answers.splunk.com/answers/32446/universal-forwarder-is-not-working-as-an-intermediate-forwar...

Greetings

Tom