Hi @gcusello , Thank bro, very helpful. ... View more

Hi Giuseppe, Thank for your helpful answer, I have one more questions, please clear it for me: 1. Does only HF support intermediate forwarder ? how about Universal forwarder ? 2. When intermediate forwarder received logs like: Syslog from Firewall, IPS, Router.... and other log from universal forwarder. What will the intermediate forwarder do ?  - Storage the log and forward to Indexer, after that, deleted the logs ? - Just forward the log, not storage logs ?  Thanks !  @gcusello  ... View more