Getting Data In

how can i configure my search head to get the data from a heavy forwarder?

pavanae
Builder

I am aware of getting the data from an universal forwarder?. Can anyone explain me the process of getting data from a heavy forwarder?

I would really appreciate if anyone can explain the step by step process of getting the data..

My splunk search head is in stand alone environment.

1 Solution

richgalloway
SplunkTrust
SplunkTrust

The first step is to enable receiving in your search head/indexer. Select Settings->Forwarding and Receiving then click "Add New" in the "Receive data" section. Use port 9997 for your first listener.
The second step is to enable forwarding in the HF. Select Settings->Forwarding and Receiving then click "Add New" in the "Forward data" section. Enter the host name or IP address of your search head along with the port number entered above.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

gcusello
SplunkTrust
SplunkTrust
0 Karma

richgalloway
SplunkTrust
SplunkTrust

The first step is to enable receiving in your search head/indexer. Select Settings->Forwarding and Receiving then click "Add New" in the "Receive data" section. Use port 9997 for your first listener.
The second step is to enable forwarding in the HF. Select Settings->Forwarding and Receiving then click "Add New" in the "Forward data" section. Enter the host name or IP address of your search head along with the port number entered above.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Digital Resilience Assessment Launch | How prepared are you for disruption?

Disruption is inevitable. The question is – how prepared are you to handle it? In today’s fast-moving digital ...

Buttercup Games: Further Dashboarding Techniques (Part 2)

This series of blogs assumes you have already completed the Splunk Enterprise Search Tutorial as it uses the ...

Index This | What is the next number in the series? 7,645 5,764 4,576…

February 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...