Forwarding Data From on Universal Forwarder to Another Universal Forwarder

[ssankeneni]

Is it possible to forward the data from one Universal Forwarder to another Universal Forwarder ? If so can you please direct me to the appropriate documentation.

[ayme · Accepted solution]

Yes. Simply configure a tcpout stanza in the outputs.conf of the first Forwarder to forward to Intermediary Forwarder:

[tcpout]
defaultGroup=intermediaryForwarder

[intermediaryForwarder]
server=myintermediaryforwarder.company.com:9997

Then, configure a splunktcp stanza in the inputs.conf of the Intermediary Forwarder:

[splunktcp://:9997]

...as well as a another tcpout in the Intermediary Forwarder to forward to Indexers:

[tcpout]
defaultGroup=indexers

[indexers]
server=myindexer:9997

[ssankeneni]

Thank you very much