Getting Data In

Is there an example configuration available for an Intermediate Forwarding configuration?


Referring to, under the section "Intermediate forwarding" - is there a configuration example available?

I'd like to see an example of a heavy forwarder.

Tags (1)


Here are sample configs from my setup (Lightweight forwarders -> Heavy forwarder -> Indexer).

My Lightweight forwarders (LWFs) are configured just like any other LWF would be configured (as in enable the lightweight forwarder app). LWF's outputs.conf. This forwards on port 9997 to the host "myHWF":

defaultGroup = myHWF_9997
disabled = false

server = myHWF:9997


Then you configure the Heavyweight forwarder (HWF) to both receive and forward data (enable the forwarder app). HWF inputs.conf. This enables receiving on port 9997:


HWF outputs.conf. This enables forwarding of data on port 9998. Note that I have disabled indexing at this HWF by setting indexAndForward to false. This keeps Splunk from indexing the events that are being forwarded to it by the LWFs. In addition I am encrypting this connection via SSL:

defaultGroup = splunk01
indexAndForward = false

server = splunk01:9998
compressed = true

sslCertPath = $SPLUNK_HOME\etc\auth\server.pem
sslRootCAPath = $SPLUNK_HOME\etc\auth\cacert.pem
sslVerifyServerCert = false

And finally at the Indexer configure your inputs.conf. Receiving on port 9998; again, with SSL settings:

compressed = true

requireClientCert = false
rootCA = $SPLUNK_HOME\etc\auth\cacert.pem
serverCert = $SPLUNK_HOME\etc\auth\server.pem

And that's basically it. Events from your LWF's get pooled at your HWF, which then sends them on to your Indexer.

.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!