Getting Data In

Can a Heavy Forwarder both be a receiver and a forwarder?

jwalzerpitt
Motivator

We currently use nxlog on our Windows domain controllers to forward logs one destination.

With nxlog I can forward the logs to another destination and I'd like to forward the Windows event logs to our Splunk instance in Azure. With that, can I forward the domain controller logs to an on-prem heavy forwarder and then have the heavy forwarder forward the domain controller logs to Splunk in Azure?

Basically, can the heavy forwarder function as both a receiver and forwarder?

Thx

0 Karma
1 Solution

harsmarvania57
SplunkTrust
SplunkTrust

Yes , heavy forwarder can receive and forward the data to another instance.

inputs.conf configuration is require for Heavy Forwarder receiver configuration and outputs.conf configuration is require for HFW forwarder configuration.

If you want to send subset of data to different splunk instances from Heavy Forwarder then you may require props.conf and transforms.conf as well.

View solution in original post

harsmarvania57
SplunkTrust
SplunkTrust

Yes , heavy forwarder can receive and forward the data to another instance.

inputs.conf configuration is require for Heavy Forwarder receiver configuration and outputs.conf configuration is require for HFW forwarder configuration.

If you want to send subset of data to different splunk instances from Heavy Forwarder then you may require props.conf and transforms.conf as well.

jwalzerpitt
Motivator

Thx for the info - much appreciated

0 Karma

jwalzerpitt
Motivator

One last question - is it possible to just forward the logs on without storing them on the heavy forwarder?

Thx

0 Karma

harsmarvania57
SplunkTrust
SplunkTrust

Yes it is possible. Generally heavy forwarder do not store any data but you need to configure outputs.conf accordingly.

jwalzerpitt
Motivator

Thx again!

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...