Hi Yes you can do it. That information is on outputs.conf. It depends how your UF has configured where you found the correct outputs.conf. You can try to find it on cmd line with command    .....\splunk cmd btool outputs list --debug   That shows where that file is. There could be a static definition (point to some named/ip based hosts) or indexer discovery (point to CM). You must just replace that to point it to your named HF (heavy forwarder) and preferably there is at least two HF nodes. Also you must think should you add IndexAck there to ensure that UF will get confirmation when data is written to indexers disks, otherwise HF told that it has gotten it, but there is no information what has happened to it after that. If you are using splunk DS then there is probably own app (server class) for basic configuration where this outputs.conf is one part. In that case just create a new app/TA on DS with proper configuration and change it to that client's use. r. Ismo https://docs.splunk.com/Documentation/Splunk/8.2.4/Forwarding/Configureanintermediateforwarder https://docs.splunk.com/Documentation/Splunk/8.2.4/Updating/Aboutdeploymentserver https://docs.splunk.com/Documentation/Splunk/8.2.4/Updating/Definedeploymentclasses   ... View more