Getting Data In

Is there an example configuration available for an Intermediate Forwarding configuration?


Referring to, under the section "Intermediate forwarding" - is there a configuration example available?

I'd like to see an example of a heavy forwarder.

Tags (1)


Here are sample configs from my setup (Lightweight forwarders -> Heavy forwarder -> Indexer).

My Lightweight forwarders (LWFs) are configured just like any other LWF would be configured (as in enable the lightweight forwarder app). LWF's outputs.conf. This forwards on port 9997 to the host "myHWF":

defaultGroup = myHWF_9997
disabled = false

server = myHWF:9997


Then you configure the Heavyweight forwarder (HWF) to both receive and forward data (enable the forwarder app). HWF inputs.conf. This enables receiving on port 9997:


HWF outputs.conf. This enables forwarding of data on port 9998. Note that I have disabled indexing at this HWF by setting indexAndForward to false. This keeps Splunk from indexing the events that are being forwarded to it by the LWFs. In addition I am encrypting this connection via SSL:

defaultGroup = splunk01
indexAndForward = false

server = splunk01:9998
compressed = true

sslCertPath = $SPLUNK_HOME\etc\auth\server.pem
sslRootCAPath = $SPLUNK_HOME\etc\auth\cacert.pem
sslVerifyServerCert = false

And finally at the Indexer configure your inputs.conf. Receiving on port 9998; again, with SSL settings:

compressed = true

requireClientCert = false
rootCA = $SPLUNK_HOME\etc\auth\cacert.pem
serverCert = $SPLUNK_HOME\etc\auth\server.pem

And that's basically it. Events from your LWF's get pooled at your HWF, which then sends them on to your Indexer.

Get Updates on the Splunk Community!

Observability Highlights | November 2022 Newsletter

 November 2022Observability CloudEnd Of Support Extension for SignalFx Smart AgentSplunk is extending the End ...

Avoid Certificate Expiry Issues in Splunk Enterprise with Certificate Assist

This blog post is part 2 of 4 of a series on Splunk Assist. Click the links below to see the other ...

Using Machine Learning for Hunting Security Threats

REGISTER NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more ...