Getting Data In

Configuration of Universal forwarder sending log to Cluster master

New Member


I have configured our cluster master to receive log in certain port and also configured the cluster master to forward to two indexer nodes.

Now we have universal forwarder installed in few servers from which we need to send the logs to cluster master instead of directly sending to two indexer nodes. Can I directly configure the output conf to point to the cluster master ip and receiver port?
or is there anything I need to configure specifically for this in cluster master?


Labels (1)
0 Karma


Universal forwarders do not send data to Cluster Masters. They merely ask the CM for a list of indexers and then send the data to them. Do that by adding indexerDiscovery = <CMname> to outputs.conf file on each UF.

If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...