Getting Data In

What's the significance of "add forward-server" on the universal forwarders?

Contributor

what's the significance of the add forward-server statement?

splunk add forward-server <host>:<port> -auth <username>:<password>

i'm documenting the forwarder install for some admins to read, and we previously had this step in there for a standalone deployment. i think we'll remove it though with our new distributed deployment.

according to the Answers and Docs it's optional, and i believe i'm hardcoding all the indexer addresses anyways in a forwarder package so it's not needed. it's just difficult for me to follow some of the docs because terminologies are used interchangeably and it sometimes becomes unclear.

0 Karma

Explorer

I know this is a super old thread but I was wondering if you could clarify:

i believe i'm hardcoding all the indexer addresses anyways in a forwarder package so it's not needed.

Do you have some documentation on this process?

Any help is appreciated.

Thanks

0 Karma

Motivator

The CLI command in question is used to configure receiving endpoint on Universal Forwarder. More info is available here. I am not sure if this is what you're looking for, but this definitely is a good starting point.

0 Karma

Explorer

thankyou for the reply but i am specifically asking about hardcoding the indexer addresses in a forwarder package

0 Karma

Motivator

In that case, you have to include outputs.conf with below settings, in your forwarder package.

## Syntax
[tcpout-server://<ip address>:<port>]

## Example
[tcpout-server://1.1.1.1:9997]

OR

##Syntax:
[tcpout:<target_group>]
server = [<ip>|<servername>]:<port>

##Example:
[tcpout:prod_indexer_group]
server = https://yourIndexer1:9997, https://yourIndexer2:9997

Please have a look at my other answer for more details on above settings. HTH!

0 Karma

Builder

The purpose of this CLI command is to add an indexer (or heavy forwarder) to outputs.conf - in a basic setup this is the CLI way to tell your forwarder where to forward to.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!