Getting Data In

Can heavy forwarders act as indexer and can be searched using search head?

New Member

I have this use case were I cannot transfer the client data from country due to their policy and my whole Splunk infra reside in different geolocation.

So my question is, what are the options do I have so that I do not have to set up the whole Splunk infra for just one client?

Can heavy forwarder serve my purpose?

0 Karma


HF is a Splunk server for forwarding to the indexer.

I think you should use a Splunk server (ALL IN ONE) or an indexer.

It's just a distributed search.

0 Karma
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes and swag!