Getting Data In
Highlighted

Forwarding Data From on Universal Forwarder to Another Universal Forwarder

Communicator

Is it possible to forward the data from one Universal Forwarder to another Universal Forwarder ? If so can you please direct me to the appropriate documentation.

Tags (1)
0 Karma
Highlighted

Re: Forwarding Data From on Universal Forwarder to Another Universal Forwarder

Splunk Employee
Splunk Employee

Yes. Simply configure a tcpout stanza in the outputs.conf of the first Forwarder to forward to Intermediary Forwarder:

[tcpout]
defaultGroup=intermediaryForwarder

[intermediaryForwarder]
server=myintermediaryforwarder.company.com:9997

Then, configure a splunktcp stanza in the inputs.conf of the Intermediary Forwarder:

[splunktcp://:9997]

...as well as a another tcpout in the Intermediary Forwarder to forward to Indexers:

[tcpout]
defaultGroup=indexers

[indexers]
server=myindexer:9997

View solution in original post

Highlighted

Re: Forwarding Data From on Universal Forwarder to Another Universal Forwarder

Communicator

Thank you very much

0 Karma