Getting Data In

Forwarding Data From on Universal Forwarder to Another Universal Forwarder

ssankeneni
Communicator

Is it possible to forward the data from one Universal Forwarder to another Universal Forwarder ? If so can you please direct me to the appropriate documentation.

Tags (1)
0 Karma
1 Solution

ayme
Splunk Employee
Splunk Employee

Yes. Simply configure a tcpout stanza in the outputs.conf of the first Forwarder to forward to Intermediary Forwarder:

[tcpout]
defaultGroup=intermediaryForwarder

[intermediaryForwarder]
server=myintermediaryforwarder.company.com:9997

Then, configure a splunktcp stanza in the inputs.conf of the Intermediary Forwarder:

[splunktcp://:9997]

...as well as a another tcpout in the Intermediary Forwarder to forward to Indexers:

[tcpout]
defaultGroup=indexers

[indexers]
server=myindexer:9997

View solution in original post

ayme
Splunk Employee
Splunk Employee

Yes. Simply configure a tcpout stanza in the outputs.conf of the first Forwarder to forward to Intermediary Forwarder:

[tcpout]
defaultGroup=intermediaryForwarder

[intermediaryForwarder]
server=myintermediaryforwarder.company.com:9997

Then, configure a splunktcp stanza in the inputs.conf of the Intermediary Forwarder:

[splunktcp://:9997]

...as well as a another tcpout in the Intermediary Forwarder to forward to Indexers:

[tcpout]
defaultGroup=indexers

[indexers]
server=myindexer:9997

ssankeneni
Communicator

Thank you very much

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In January, the Splunk Threat Research Team had one release of new security content via the Splunk ES Content ...

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...