Getting Data In

Restrict Indexer to receive data from a forwarder

parth_jec
Path Finder

Hi,

I have configured an indexer to receive data from universal forwarder. Is it possible to specify a list of forwarders in the indexer such that the indexer will recieve data only from the forwarders specified in the list?

Tags (2)
0 Karma
1 Solution

lguinn2
Legend

Yes, in inputs.conf on the indexer:

Instead of

[splunktcp://:9997]

Use one stanza for each host, like this

[splunktcp://host1.mycompany.com:9996]

[splunktcp://host2.mycompany.com:9996]

[splunktcp://host3.mycompany.com:9996]

View solution in original post

lguinn2
Legend

Yes, in inputs.conf on the indexer:

Instead of

[splunktcp://:9997]

Use one stanza for each host, like this

[splunktcp://host1.mycompany.com:9996]

[splunktcp://host2.mycompany.com:9996]

[splunktcp://host3.mycompany.com:9996]

View solution in original post

parth_jec
Path Finder

It worked! but first I had to disable the 9997 port from listening.

Thanks

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!