Getting Data In

Forwarding between multiple forwarders then to indexer


My Splunk architecture is like this

I have three data centers (DC) and one each heavy forwarder in them .In each DC all the servers are forwarding the logs to heavy forwarder of the same DC via universal forwarders

I also have existing spunk set up in distributed architecture with two heavy forwarders two indexer and two search head.
Only heavy forwarders are routable in our environment and receives logs from infrastructure devices and then sending further to indexers in LB mode.

So, i would like to know if we can forward logs from heavy forwarder in each DC to this existing routable heavy forwarder then further to indexer I have read few answers regarding UF sending logs to intermediate forrwarder and then further to indexers. but could not find any specific answers on documentation on forwarding log between two or multiple heavy forwarders.

Many thanks in advance...

Tags (1)
0 Karma


Thanks .

Can we send unparsed logs from each DC to routable heavy forwarders. I wanted to route logs from each DC to specific indexes dedicated for these DC. Which is the best place to configure logs routing DC indexes or routable indexes. At the moment all infrastructure logs routing is done in routable forwarder. I will appreciate if you can help with sample configuration.

0 Karma

Splunk Employee
Splunk Employee

Yes you can.

Get Updates on the Splunk Community!

Sending Metrics to Splunk Enterprise With the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

What's New in Splunk Cloud Platform 9.0.2208?!

Howdy!  We are happy to share the newest updates in Splunk Cloud Platform 9.0.2208! Analysts can benefit ...

Want a chance to win $500 to the Splunk shop? Take our IT Incident Management Survey!

  Top Trends & Best Practices in Incident ManagementSplunk is partnering up with Constellation Research to ...