Is it possible to send data from universal forwarder to multiple heavy forwarders?
if yes how can specify the HF group.
Yes you can forward it to multiple HF. You need to do configuration in outputs.conf as below
defaultGroup = HF_GRP_1, HF_GRP_2
disabled = false
server = 10.10.0.1:9997,10.10.0.2:9997
server = 10.20.0.1:9997,10.20.0.2:9997
Above configuration will forward all data to both the HF groups, if you have any specific requirement to route subset of data to different HF group then please provide more details.
View solution in original post