Getting Data In

Can a Splunk enterprise instance set as an indexer/head be a heavy forwarder too?

New Member

Trying to forward the logs that arrive into the indexer/head into another 3rd party Siem tool. Rather than setting the universal forwarders to do this (two destinations) I was thinking that since they have already arrived to single location I can get a copy and send them to another tool.

Is that even possible? if so what are the cons with this?

Any insight would be greatly appreciated.


0 Karma

Path Finder

yes, you can enable the index and forward option but this will work to forward to another splunk indexer because the data has been already cooked. The alternative is to use props and transfrorms to change the routing to use syslog to avoid additional splunk headers.

0 Karma


Hi @wiredaemon

When you say indexer/head, are you saying indexer and search head? Can you clarify what you mean?

As for an indexer being a heavy forwarder, that's pretty much the definition of a heavy forwarder A heavy forwarder is a Splunk Enterprise instance that not only forwards data, but can parse and index data as well. The cons will vary depending on the type of environment you're running, resources, and how much data you're expecting the heavy forwarder to process. I'm sure other users can chime in with more specifics on this

New Member

Thanks for responding. Yes, I meant indexer & search-head . We have a a single-machine deployment from what I understand(One Enterprise splunk server where our universal fwds point to Un*x and Windows).

0 Karma
Get Updates on the Splunk Community!

Introducing Edge Processor: Next Gen Data Transformation

We get it - not only can it take a lot of time, money and resources to get data into Splunk, but it also takes ...

Take the 2021 Splunk Career Survey for $50 in Amazon Cash

Help us learn about how Splunk has impacted your career by taking the 2021 Splunk Career Survey. Last year’s ...

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...