Forwarding between multiple forwarders then to indexer

[ramsanga]

My Splunk architecture is like this

I have three data centers (DC) and one each heavy forwarder in them .In each DC all the servers are forwarding the logs to heavy forwarder of the same DC via universal forwarders

I also have existing spunk set up in distributed architecture with two heavy forwarders two indexer and two search head.
Only heavy forwarders are routable in our environment and receives logs from infrastructure devices and then sending further to indexers in LB mode.

So, i would like to know if we can forward logs from heavy forwarder in each DC to this existing routable heavy forwarder then further to indexer I have read few answers regarding UF sending logs to intermediate forrwarder and then further to indexers. but could not find any specific answers on documentation on forwarding log between two or multiple heavy forwarders.

Many thanks in advance...

[ramsanga]

Thanks .

Can we send unparsed logs from each DC to routable heavy forwarders. I wanted to route logs from each DC to specific indexes dedicated for these DC. Which is the best place to configure logs routing DC indexes or routable indexes. At the moment all infrastructure logs routing is done in routable forwarder. I will appreciate if you can help with sample configuration.

[yannK]

Yes you can.