Getting Data In
Highlighted

Can a Heavy Forwarder both be a receiver and a forwarder?

Motivator

We currently use nxlog on our Windows domain controllers to forward logs one destination.

With nxlog I can forward the logs to another destination and I'd like to forward the Windows event logs to our Splunk instance in Azure. With that, can I forward the domain controller logs to an on-prem heavy forwarder and then have the heavy forwarder forward the domain controller logs to Splunk in Azure?

Basically, can the heavy forwarder function as both a receiver and forwarder?

Thx

0 Karma
Highlighted

Re: Can a Heavy Forwarder both be a receiver and a forwarder?

SplunkTrust
SplunkTrust

Yes , heavy forwarder can receive and forward the data to another instance.

inputs.conf configuration is require for Heavy Forwarder receiver configuration and outputs.conf configuration is require for HFW forwarder configuration.

If you want to send subset of data to different splunk instances from Heavy Forwarder then you may require props.conf and transforms.conf as well.

View solution in original post

Highlighted

Re: Can a Heavy Forwarder both be a receiver and a forwarder?

Motivator

Thx for the info - much appreciated

0 Karma
Highlighted

Re: Can a Heavy Forwarder both be a receiver and a forwarder?

Motivator

One last question - is it possible to just forward the logs on without storing them on the heavy forwarder?

Thx

0 Karma
Highlighted

Re: Can a Heavy Forwarder both be a receiver and a forwarder?

SplunkTrust
SplunkTrust

Yes it is possible. Generally heavy forwarder do not store any data but you need to configure outputs.conf accordingly.

Highlighted

Re: Can a Heavy Forwarder both be a receiver and a forwarder?

Motivator

Thx again!

0 Karma