Can I forward Splunk cooked data between two HF?

[GaetanVP]

Hello Splunkers,

Do you know if I can forward cooked data from my HF1 to my HF2 ? (I tried from one HF to a Standalone Splunk instance, but never from HF to HF).

I am wondering if there is something to set on the HF2 to tell "do not try to parse any incoming data for this input"

Thanks a lot,

GaetanVP

[lfleyloh]

Hi， Now I want to forward data from HF to a single instance, can you tell me your steps? Thank you very much.

[isoutamo]

Hi

this is the normal way how splunk instances are sending with splunktcp protocol. 

You just define in outputs.conf on HF1 that your target instance is you HF2 and there just listening splunktcp input (or splunktcp-ssl is preferred way).

No need to take care of additional parsing as all data manipulations have done on 1st full splunk instance which is in your case HF1. You should remember that this apply also to indexers if you have any HF before it!!

r. Ismo