Getting Data In

Using UF to forward data to local Heavy Forwarder and then on to Cloud

damo66a
Explorer

I may have missed a topic in my search but is there a way to do the following (im also fairly new to Splunk so be gentle 😁 )

We have a server locked down on our network and has no outside access but we can configure internal (server to server) access. 

Is there a way to use a Universal Forwarder on that server to forward to the local on prem Heavy Forwarder and then relay those to our Splunk Cloud?

Thanks in advance

0 Karma
1 Solution

aasabatini
Builder

Hello @damo66a  again,

yes you can configure the uf to send to HF and in the end at splunkcloud

be careful to to configure your outputs.conf

https://docs.splunk.com/Documentation/Splunk/8.1.3/Admin/outputsconf

https://docs.splunk.com/Documentation/Forwarder/8.1.3/Forwarder/HowtoforwarddatatoSplunkEnterprise

suggestion, if you have a huge size of eventdata you can think to use 2 hf to use the splunk load-balancing options

 

View solution in original post

0 Karma

aasabatini
Builder

Hello @damo66a  again,

yes you can configure the uf to send to HF and in the end at splunkcloud

be careful to to configure your outputs.conf

https://docs.splunk.com/Documentation/Splunk/8.1.3/Admin/outputsconf

https://docs.splunk.com/Documentation/Forwarder/8.1.3/Forwarder/HowtoforwarddatatoSplunkEnterprise

suggestion, if you have a huge size of eventdata you can think to use 2 hf to use the splunk load-balancing options

 

View solution in original post

0 Karma

damo66a
Explorer

worked a treat. thanks for your help

0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!