Getting Data In

Configuration of Universal forwarder sending log to Cluster master

New Member


I have configured our cluster master to receive log in certain port and also configured the cluster master to forward to two indexer nodes.

Now we have universal forwarder installed in few servers from which we need to send the logs to cluster master instead of directly sending to two indexer nodes. Can I directly configure the output conf to point to the cluster master ip and receiver port?
or is there anything I need to configure specifically for this in cluster master?


Labels (1)
0 Karma


Universal forwarders do not send data to Cluster Masters. They merely ask the CM for a list of indexers and then send the data to them. Do that by adding indexerDiscovery = <CMname> to outputs.conf file on each UF.

If this reply helps you, an upvote would be appreciated.
0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!