Can we configure some Universal Forwarders to forward data to port 9998 with SSL on indexers and the remaining Universal Forwarders to forward data to port 9997 without SSL on same indexers?

[ankithreddy777]

Can we configure some Universal Forwarders to forward data to port 9998 with SSL on indexers and the remaining Universal Forwarders to forward data to port 9997 without SSL on same indexers? If yes, what do we need to configure?

[gcusello · Accepted solution]

Hi ankithreddy777,
Yes you can:
you have to configure your forwarders with two different outputs.conf: one with SSL and port 9998 and one without SSL and port 9997.
in you indexers you have to modify inputs.conf and serve.conf file as described in https://docs.splunk.com/Documentation/Splunk/6.5.1/Security/ConfigureSplunkforwardingtousethedefault...
You have to create two stanzas:
[splunktcp-ssl:9998]
[splunktcp:9997]

Bye.
Giuseppe