Can you help me configure my universal forwarder (UF) to relay data to another UF?

[TitanAE]

So something interesting I found out: you can configure universal forwarder relaying.

Basically one universal forwarder can relay data to another universal forwarder. Which in turn can relay data to an indexer.

I'm trying to set it up as practice. I have a basic output.conf on forwarder 1 ->

[tcpout]
defaultGroup = default-autolb-group
server = universal_forwarder_relay_IP:9997

[tcpout:default-autolb-group]

The UF Relay also has an input.conf that listens for connections coming from the 1st UF.

[default]
host = x.x.x.x

[splunktcp://1st_UF:xxx]

However I'm getting this output:

--splunk-cooked-mode-v3--\x00\x00\x00\x00\x00

I'm not sure why I'm getting this data and not the contents of the 1st forwarder. Any help is appreciated.

[harsmarvania57]

Hi @TitanAE,

You can do below configuration to achieve this

• Forwarder 1 will send data to Intermediate Universal Forwarder so below configuration is require on Forwarder 1

outputs.conf

[tcpout]
defaultGroup = intermediate_UF

[tcpout:intermediate_UF]
server = Intermediate_UF_IP:9997

• Below configuration is require on Intermediate Universal Forwarder to receive data from Forwarder 1.

inputs.conf

[splunktcp://9997]
connection_host = ip

• Below configuration is require on Intermediate Universal Forwarder to send data to Indexer.

outputs.conf

[tcpout]
defaultGroup = Indexers

[tcpout:Indexers]
server = Indexer_IP:9997

And after configuration changes restart splunk service on both Universal Forwarder