Can a Splunk enterprise instance set as an indexer/head be a heavy forwarder too?

[wiredaemon]

Trying to forward the logs that arrive into the indexer/head into another 3rd party Siem tool. Rather than setting the universal forwarders to do this (two destinations) I was thinking that since they have already arrived to single location I can get a copy and send them to another tool.

Is that even possible? if so what are the cons with this?

Any insight would be greatly appreciated.

Thanks,

[aalanisr26]

yes, you can enable the index and forward option but this will work to forward to another splunk indexer because the data has been already cooked. The alternative is to use props and transfrorms to change the routing to use syslog to avoid additional splunk headers.

[ppablo]

Hi @wiredaemon

When you say indexer/head, are you saying indexer and search head? Can you clarify what you mean?

As for an indexer being a heavy forwarder, that's pretty much the definition of a heavy forwarder http://docs.splunk.com/Splexicon:Heavyforwarder A heavy forwarder is a Splunk Enterprise instance that not only forwards data, but can parse and index data as well. The cons will vary depending on the type of environment you're running, resources, and how much data you're expecting the heavy forwarder to process. I'm sure other users can chime in with more specifics on this

[wiredaemon]

Thanks for responding. Yes, I meant indexer & search-head . We have a a single-machine deployment from what I understand(One Enterprise splunk server where our universal fwds point to Un*x and Windows).