Join the Conversation
- Find Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- Re: Can a Heavy Forwarder both be a receiver and a...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
We currently use nxlog on our Windows domain controllers to forward logs one destination.
With nxlog I can forward the logs to another destination and I'd like to forward the Windows event logs to our Splunk instance in Azure. With that, can I forward the domain controller logs to an on-prem heavy forwarder and then have the heavy forwarder forward the domain controller logs to Splunk in Azure?
Basically, can the heavy forwarder function as both a receiver and forwarder?
Thx
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Yes , heavy forwarder can receive and forward the data to another instance.
inputs.conf configuration is require for Heavy Forwarder receiver configuration and outputs.conf configuration is require for HFW forwarder configuration.
If you want to send subset of data to different splunk instances from Heavy Forwarder then you may require props.conf and transforms.conf as well.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Yes , heavy forwarder can receive and forward the data to another instance.
inputs.conf configuration is require for Heavy Forwarder receiver configuration and outputs.conf configuration is require for HFW forwarder configuration.
If you want to send subset of data to different splunk instances from Heavy Forwarder then you may require props.conf and transforms.conf as well.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thx for the info - much appreciated
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
One last question - is it possible to just forward the logs on without storing them on the heavy forwarder?
Thx
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Yes it is possible. Generally heavy forwarder do not store any data but you need to configure outputs.conf accordingly.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thx again!
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
SOC4Kafka - New Kafka Connector Powered by OpenTelemetry
Event Series: Level up your SOC: Advancing with Splunk Enterprise Security
Announcing Modern Navigation: A New Era of Splunk User Experience
