Getting Data In

Configuration of Universal forwarder sending log to Cluster master

gopankallazhy
New Member

Hello,

I have configured our cluster master to receive log in certain port and also configured the cluster master to forward to two indexer nodes.

Now we have universal forwarder installed in few servers from which we need to send the logs to cluster master instead of directly sending to two indexer nodes. Can I directly configure the output conf to point to the cluster master ip and receiver port?
or is there anything I need to configure specifically for this in cluster master?

Thanks,
Gopa

Labels (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Universal forwarders do not send data to Cluster Masters. They merely ask the CM for a list of indexers and then send the data to them. Do that by adding indexerDiscovery = <CMname> to outputs.conf file on each UF.

---
If this reply helps you, an upvote would be appreciated.
0 Karma