Getting Data In

Forwarding between multiple forwarders then to indexer


My Splunk architecture is like this

I have three data centers (DC) and one each heavy forwarder in them .In each DC all the servers are forwarding the logs to heavy forwarder of the same DC via universal forwarders

I also have existing spunk set up in distributed architecture with two heavy forwarders two indexer and two search head.
Only heavy forwarders are routable in our environment and receives logs from infrastructure devices and then sending further to indexers in LB mode.

So, i would like to know if we can forward logs from heavy forwarder in each DC to this existing routable heavy forwarder then further to indexer I have read few answers regarding UF sending logs to intermediate forrwarder and then further to indexers. but could not find any specific answers on documentation on forwarding log between two or multiple heavy forwarders.

Many thanks in advance...

Tags (1)
0 Karma


Thanks .

Can we send unparsed logs from each DC to routable heavy forwarders. I wanted to route logs from each DC to specific indexes dedicated for these DC. Which is the best place to configure logs routing DC indexes or routable indexes. At the moment all infrastructure logs routing is done in routable forwarder. I will appreciate if you can help with sample configuration.

0 Karma

Splunk Employee
Splunk Employee

Yes you can.

Get Updates on the Splunk Community!

New Cloud Intrusion Detection System Add-on for Splunk

In July 2022 Splunk released the Cloud IDS add-on which expanded Splunk capabilities in security and data ...

Happy CX Day to our Community Superheroes!

Happy 10th Birthday CX Day!What is CX Day? It’s a global celebration recognizing innovation and success in the ...

Check out This Month’s Brand new Splunk Lantern Articles

Splunk Lantern is a customer success center providing advice from Splunk experts on valuable data insights, ...