Getting Data In

How to get two universal forwarders running from one Linux box?

dharanpdeepak
Explorer

Hello,

Please could anyone advice me, how I can get two instance of Universal forwarders run from one Linux Box? I am aware that we can use a single forwarder to forward to multiple indexes; however in my case I am not allowed to touch or alter the existing forwarder as it is mission critical; however I am tasked to do a POC to confirm the forwarding will work to a sandbox machine where we are testing some new Splunk server configurations.

Please can someone help me resolve this problem ?

Thanks.

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

It's pretty simple. All you have to do is unzip or uninstall to a different location. When you start up the first time, it will also ask you to change ports (since the default one will be occupied). Pick a new port number (it doesn't matter what). That's all.

Get Updates on the Splunk Community!

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...

Index This | What goes away as soon as you talk about it?

May 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...

What's New in Splunk Observability Cloud and Splunk AppDynamics - May 2025

This month, we’re delivering several new innovations in Splunk Observability Cloud and Splunk AppDynamics ...