Can I use a Splunk forwarder to forward logs from one universal forwarder to particular folder of another universal forwarder?

[sravankaripe]

Hi,

I have a use case to forward Application logs from one universal forwarder server to particular folder of another universal forwarder server.

How can I do that?
How & where should I specify the folder detail of another server?

[aaraneta_splunk]

Hi @sravankaripe - I got a notification that you accepted the answer by esix but then I saw this post and it was unaccepted. Did you accidentally unaccept the answer?

[sravankaripe]

i accidentally done that.

[aaraneta_splunk]

Thanks for confirming, I've accepted the answer on your behalf.

[esix_splunk · Accepted solution]

Splunk doesnt work this way. It doesnt forward log files. It ingests and parses logs files and forwards the log files to an indexing tier where they are compressed and indexed and stored on disk.

Universal Forwarders are used for ingesting of the logs on the endpoints.

Sounds like you want to use the OS to copy files to another server and then use Splunk to ingest the logs on that server.