Is it possible to forward the data from one Universal Forwarder to another Universal Forwarder ? If so can you please direct me to the appropriate documentation.
Yes. Simply configure a tcpout stanza in the outputs.conf of the first Forwarder to forward to Intermediary Forwarder:
Then, configure a splunktcp stanza in the inputs.conf of the Intermediary Forwarder:
...as well as a another tcpout in the Intermediary Forwarder to forward to Indexers:
View solution in original post
Thank you very much