Restrict Indexer to receive data from a forwarder

[parth_jec]

Hi,

I have configured an indexer to receive data from universal forwarder. Is it possible to specify a list of forwarders in the indexer such that the indexer will recieve data only from the forwarders specified in the list?

[lguinn2 · Accepted solution]

Yes, in inputs.conf on the indexer:

Instead of

[splunktcp://:9997]

Use one stanza for each host, like this

[splunktcp://host1.mycompany.com:9996]

[splunktcp://host2.mycompany.com:9996]

[splunktcp://host3.mycompany.com:9996]

[parth_jec]

It worked! but first I had to disable the 9997 port from listening.

Thanks