Getting Data In

what would be the Host IP address of Forward data under Forwarding and receiving

gauravreva
New Member

I have installed splunk enterprise and wanted to configure receiving and forwarding. For receiving I know the default port is 9997, but I want to know what would I update in Forwarding in "Host" field. would it be my IPV4: 9997 or there should be any speicific IP related to search head. Please help

Tags (1)
0 Karma

manjunathmeti
Champion

Forwarding is configured to send data from this search head to an external server. If you need to forward any data from this search head to any external server like syslog, another splunk instance then provide that instance IP and port on which data is received on that instance in IP:port format.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @gauravreva,
as you can see at https://docs.splunk.com/Documentation/Forwarder/8.0.3/Forwarder/Configuretheuniversalforwarder you can set the address in Universal Forwarders in two ways:

The best approach is creating a dedicated technical Add-On (called e.g. TA_Forwarders) that contains only two files:

and deploy it in $SPLUNK_HOME/etc/apps.

Remember to restart Splunk after the updates!

The "host" field in Universal Forwarder is the hostname of the UF (contained in server.conf and inputs.conf), so you don't touch it, to address forwardering, the correct conf file to use is outputs.conf.

Ciao.
Giuseppe

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...