I have installed splunk enterprise and wanted to configure receiving and forwarding. For receiving I know the default port is 9997, but I want to know what would I update in Forwarding in "Host" field. would it be my IPV4: 9997 or there should be any speicific IP related to search head. Please help
Forwarding is configured to send data from this search head to an external server. If you need to forward any data from this search head to any external server like syslog, another splunk instance then provide that instance IP and port on which data is received on that instance in IP:port format.
The "host" field in Universal Forwarder is the hostname of the UF (contained in server.conf and inputs.conf), so you don't touch it, to address forwardering, the correct conf file to use is outputs.conf.