Getting Data In

How to get two universal forwarders running from one Linux box?

dharanpdeepak
Explorer

Hello,

Please could anyone advice me, how I can get two instance of Universal forwarders run from one Linux Box? I am aware that we can use a single forwarder to forward to multiple indexes; however in my case I am not allowed to touch or alter the existing forwarder as it is mission critical; however I am tasked to do a POC to confirm the forwarding will work to a sandbox machine where we are testing some new Splunk server configurations.

Please can someone help me resolve this problem ?

Thanks.

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

It's pretty simple. All you have to do is unzip or uninstall to a different location. When you start up the first time, it will also ask you to change ports (since the default one will be occupied). Pick a new port number (it doesn't matter what). That's all.

Get Updates on the Splunk Community!

Developer Spotlight with Brett Adams

In our third Spotlight feature, we're excited to shine a light on Brett—a Splunk consultant, innovative ...

Index This | What can you do to make 55,555 equal 500?

April 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Say goodbye to manually analyzing phishing and malware threats with Splunk Attack ...

In today’s evolving threat landscape, we understand you’re constantly bombarded with phishing and malware ...