@rasikmhetre wrote: I need help in sending data to two output types, [tcpout] and [httpout]. Is this possible? Because when I am using outputs.conf and pointing it to two output types, I can only see data to [httpout] https://hecendpoint:8088 and data is not going to another indexer which is of [tcpout] indexerip:9997 No, you can not use [httpout] in tandem with either [tcpout] or [syslog].  The following text states this is true for UFs and light forwarders.  It also states httpout is only supported on UFs but it works on HFs as well. I've tested with both httpout and tcpout but httpout will take precedence every-time.  https://docs.splunk.com/Documentation/Forwarder/9.0.3/Forwarder/Configureforwardingwithoutputs.conf  Configure the universal forwarder to send data over hyper text transfer protocol (HTTP) between Splunk platform instances when you are unable to open network traffic to use the Splunk to Splunk (S2S) service. A Splunk universal forwarder instance can perform either httpout or tcpout, but not both at the same time. There is currently no support to send ACKs to the client transaction. To configure a universal forwarder to send data over HTTP, add an httpout stanza to the outputs.conf file on your universal forwarder. It also states that  ... View more