Getting Data In

Can a Splunk enterprise instance set as an indexer/head be a heavy forwarder too?

wiredaemon
New Member

Trying to forward the logs that arrive into the indexer/head into another 3rd party Siem tool. Rather than setting the universal forwarders to do this (two destinations) I was thinking that since they have already arrived to single location I can get a copy and send them to another tool.

Is that even possible? if so what are the cons with this?

Any insight would be greatly appreciated.

Thanks,

0 Karma

aalanisr26
Path Finder

yes, you can enable the index and forward option but this will work to forward to another splunk indexer because the data has been already cooked. The alternative is to use props and transfrorms to change the routing to use syslog to avoid additional splunk headers.

0 Karma

ppablo
Retired

Hi @wiredaemon

When you say indexer/head, are you saying indexer and search head? Can you clarify what you mean?

As for an indexer being a heavy forwarder, that's pretty much the definition of a heavy forwarder http://docs.splunk.com/Splexicon:Heavyforwarder A heavy forwarder is a Splunk Enterprise instance that not only forwards data, but can parse and index data as well. The cons will vary depending on the type of environment you're running, resources, and how much data you're expecting the heavy forwarder to process. I'm sure other users can chime in with more specifics on this

wiredaemon
New Member

Thanks for responding. Yes, I meant indexer & search-head . We have a a single-machine deployment from what I understand(One Enterprise splunk server where our universal fwds point to Un*x and Windows).

0 Karma
Get Updates on the Splunk Community!

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...