Forwarding vs. Receiving - Local Inputs vs. Forwarded inputs

[eholz1]

Hello All,
This forum is a great help. I had yet to resolve an issue with splunk forwarding and receiving.
I have a universal forwarder installed on a linux machine. I have a splunk enterprise instance on a different linux machine.
What is the correct way to get forwarded data from the forwarding machine to the receiver?
I have the forwarder set to send data from a log file via port 997, and have an index name in the outputs.conf file

There seems to be two (at least two) ways to get this data on the receiver: create a local input from the Data Inputs option,
or create the same type of capability from the "Forwarded Inputs" section of the Data Inputs area. This never seems to work.

The only way I can get data in is by NOT setting up a receiver, and configuring a "local" connection to port 9997 to listen for data
from the forwarder.

I also read where the data needs to be compressed on both the forwarder and the receiver - I see I can add a line to forwarder outputs.conf : compressed = true, would I have to do the same thing for the inputs.conf on the receiving splunk instance?

thanks for a very interesting product,

eholz1

[anthonymelita · Accepted solution]

Both of the options you mention for creating Data Inputs are mechanisms for generating an "inputs.conf" file/entry. This is what tells the splunkd process to read a file. So what you have done with creating the TCP listener for 9997 is the correct portion of Receiving data. It's telling your Splunk Enterprise instance that remote forwarders will send data over that channel.
Have a read through the documentation for a better understanding. Splunk® Enterprise
Getting Data In