Getting Data In

how can i configure my search head to get the data from a heavy forwarder?

pavanae
Builder

I am aware of getting the data from an universal forwarder?. Can anyone explain me the process of getting data from a heavy forwarder?

I would really appreciate if anyone can explain the step by step process of getting the data..

My splunk search head is in stand alone environment.

1 Solution

richgalloway
SplunkTrust
SplunkTrust

The first step is to enable receiving in your search head/indexer. Select Settings->Forwarding and Receiving then click "Add New" in the "Receive data" section. Use port 9997 for your first listener.
The second step is to enable forwarding in the HF. Select Settings->Forwarding and Receiving then click "Add New" in the "Forward data" section. Enter the host name or IP address of your search head along with the port number entered above.

---
If this reply helps you, an upvote would be appreciated.

View solution in original post

0 Karma

gcusello
Legend
0 Karma

richgalloway
SplunkTrust
SplunkTrust

The first step is to enable receiving in your search head/indexer. Select Settings->Forwarding and Receiving then click "Add New" in the "Receive data" section. Use port 9997 for your first listener.
The second step is to enable forwarding in the HF. Select Settings->Forwarding and Receiving then click "Add New" in the "Forward data" section. Enter the host name or IP address of your search head along with the port number entered above.

---
If this reply helps you, an upvote would be appreciated.

View solution in original post

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!