Getting Data In
Highlighted

Can I use a Splunk forwarder to forward logs from one universal forwarder to particular folder of another universal forwarder?

Path Finder

Hi,

I have a use case to forward Application logs from one universal forwarder server to particular folder of another universal forwarder server.

How can I do that?
How & where should I specify the folder detail of another server?

0 Karma
Highlighted

Re: Can I use a Splunk forwarder to forward logs from one universal forwarder to particular folder of another universal forwarder?

Splunk Employee
Splunk Employee

Splunk doesnt work this way. It doesnt forward log files. It ingests and parses logs files and forwards the log files to an indexing tier where they are compressed and indexed and stored on disk.

Universal Forwarders are used for ingesting of the logs on the endpoints.

Sounds like you want to use the OS to copy files to another server and then use Splunk to ingest the logs on that server.

View solution in original post

0 Karma
Highlighted

Re: Can I use a Splunk forwarder to forward logs from one universal forwarder to particular folder of another universal forwarder?

Splunk Employee
Splunk Employee

Hi @sravankaripe - I got a notification that you accepted the answer by esix but then I saw this post and it was unaccepted. Did you accidentally unaccept the answer?

0 Karma
Highlighted

Re: Can I use a Splunk forwarder to forward logs from one universal forwarder to particular folder of another universal forwarder?

Path Finder

i accidentally done that.

0 Karma
Highlighted

Re: Can I use a Splunk forwarder to forward logs from one universal forwarder to particular folder of another universal forwarder?

Splunk Employee
Splunk Employee

Thanks for confirming, I've accepted the answer on your behalf.

0 Karma