Is it possible to send Fortigate logs to multiple indexers via forwarders?

[sympatiko]

Hi,

Good day splunkers. Is it the possible to forward Fortigate logs to multiple indexers via forwarders?, I already tested sending logs from fortigate via TCP to my splunk indexer TCP port 10514, I can only see logs like this "Content-type: application/beep+xml" "". But when I forward the logs by default UDP 514 to splunk via UDP 10514 all is working fine. My question now is how can I forward logs via UDP from my fortigate to 3 splunk indexers? If it is configuring a forwarder, can someone walk me through it's step by step configuration for receiving and sending?

Thanks,

[sympatiko · Accepted solution]

I already fixed this one. I configured a universal splunk forwarder.