heavy forwarder configuration

[rriley]

I want to configure a server as a heavy forwarder. I'm not clear that I understand how to ship the logs from the heavy forwarder to the indexer. Does an input have to be configured on the forwarder?

Seems my indexer is listening on the configured port 5000 okay.

At this point, I have configured the forwarder with defaults (except I'm using port 5000). The same for the receiving indexer (port 5000 again.) But I am not getting any data from the heavy forwarder... does an input have to be configured on the forwarder????

Splunkd.Log says something is wrong with SSL ( which I did not configure)

Is there a complete configuration guide for forwarders? The documentation seems so inadequate to completely describe the steps to set this up...

04-12-2011 13:11:08.603 ERROR TcpInputFd - SSL Error = error:00000000:lib(0):func(0):reason(0) 04-12-2011 13:11:08.603 ERROR TcpInputFd - ACCEPT_RESULT=0 VERIFY_RESULT=0 04-12-2011 13:11:08.603 ERROR TcpInputFd - SSL Error for fd from HOST:(myhost name)

thanks in advance.

[mamaral]

Hi, here in mine environmental i've more than 600 universal forwarders sending data to 2 heavy forwarder. So try it this:

---

outputs.conf on heavy forwarder

[tcpout:LB_indexers]

autoLB=true

server=IP INDEXER A:5000,IP INDEXER B:5000

autoLBFrequency=7

[tcpout]

defaultGroup=LB_indexers

disabled=false

---

inputs.conf on heavy forwarder

[splunktcp://7700]

---

inputs.conf on indexer

[splunktcp://5000]

---

outputs.conf on universal forwarder

[tcpout:LB_forwarders]

autoLB=true

server=IP HEAVY FORWARDER A:7700,IP HEAVY FORWARDER A:7700

autoLBFrequency=7

[tcpout]

defaultGroup=LB_forwarders

disabled=false

---

AMARAL

[fabiocaldas]

Thanks for your anwser and I just would like to remember everyone to restart splunk after setup files.
Again, thanks your anwsers were perfect.