Splunk doesnt work this way. It doesnt forward log files. It ingests and parses logs files and forwards the log files to an indexing tier where they are compressed and indexed and stored on disk.
Universal Forwarders are used for ingesting of the logs on the endpoints.
Sounds like you want to use the OS to copy files to another server and then use Splunk to ingest the logs on that server.
Hi @sravankaripe - I got a notification that you accepted the answer by esix but then I saw this post and it was unaccepted. Did you accidentally unaccept the answer?
i accidentally done that.
Thanks for confirming, I've accepted the answer on your behalf.