Documentation > Splunk > Admin Manual > Set up forwarding

Admin Manual

 


Welcome
What to do first
Start Splunk
Meet Splunk Web and Splunk Apps
Before you configure
Add data and configure inputs
Indexing and event processing
Timestamps
Add and manage users
Manage indexes
Define alerts
Set up backups and retention policies
Configure data security
Set up forwarding and receiving
Deploy to other Splunk instances
Set up distributed search
Manage search jobs
Use Splunk's command line interface (CLI)
Configuration file reference
Troubleshooting

Set up forwarding

This documentation does not apply to the most recent version of Splunk. Click here for the latest version.

Contents

Set up forwarding

This topic discusses the options you have when configuring Splunk forwarders. You have the following preconfigured forwarder choices:

If you enable the Splunk forwarder (but not the light forwarder), you also have the option to store a local copy of the indexed data on the forwarding host.

Read this before you enable Splunk forwarder or light forwarder

Forwarding OS app data from one OS to a different OS

If you're using the OS specific apps such as the *NIX app or the Windows app, and forwarding from one OS to a different OS (for example, from Windows to a Linux indexer), you should install the OS-specific App for the forwarder's OS on the indexer in order to view the data. For example, if you're forwarding from Windows to Linux, you should install the Splunk for Windows App on the Linux receiver. Once you've downloaded the relevant OS-specific App, rename or delete the inputs.conf for that App (for the Windows App, it's $SPLUNK_HOME/etc/apps/windows/default/inputs.conf before enabling the App to ensure its default inputs are not added to your indexer.

What's the Splunk forwarder?

The Splunk forwarder is a version of Splunk that allows you to send data to a central Splunk indexer or group of indexers. The distributed search module is disabled for the Splunk forwarder (in $SPLUNK_HOME/etc/apps/SplunkForwarder/default/default-mode.conf): 

[pipeline:distributedSearch]
disabled = true

All other functions and modules remain enabled.

For a detailed view of the exact configuration, you can look at the configuration files for the SplunkForwarder application in $SPLUNK_HOME/etc/apps/SplunkForwarder/default, where SPLUNK_HOME is the directory into which you installed Splunk.

What's the Splunk light forwarder?

The Splunk light forwarder is a lightweight version of Splunk that can monitor local log files and directories, collect Windows event logs and use scripted inputs (including local WMI and registry data sources on Windows). To cut down on overhead, many other features of the standard Splunk server are disabled.

Specifically, the Splunk light forwarder: 

[pipeline:indexerPipe]
disabled_processors= indexandforward, diskusage, signing,tcp-output-generic-processor, 
syslog-output-generic-processor, http-output-generic-processor, stream-output-processor

[pipeline:distributedDeployment]
disabled = true

[pipeline:distributedSearch]
disabled = true

[pipeline:fifo]
disabled = true

[pipeline:merging]
disabled = true

[pipeline:typing]
disabled = true

[pipeline:udp]
disabled = true

[pipeline:tcp]
disabled = true

[pipeline:syslogfifo]
disabled = true

[pipeline:syslogudp]
disabled = true

[pipeline:parsing]
disabled_processors=utf8, linebreaker, header, sendOut

These modules are the deployment server (not the deployment client), distributed search, and from named pipes / FIFOs, and direct input from network ports.

Configure and enable forwarding in Splunk Web

When you enable forwarding (not lightweight forwarding) in Splunk Web, you can choose to have a copy of the indexed data stored locally on this host as well as forwarded to each receiver. To do this:

1. Log into Splunk Web.

2. Click Manager in the upper right corner.

3. Click Forwarding and receiving > Forwarding defaults.

4. Select Yes to store and maintain a local copy of the indexed data on this host. This setting does not take effect if you subsequently enable lightweight forwarding.

To enable Splunk forwarder or light forwarder via Splunk Web:

1. Log into Splunk Web.

2. Click Manager in the upper right corner.

3. Click Forwarding and receiving.

4. Choose a forwarding option:

Important: Remember, if you enable Splunk light forwarder, Splunk Web will subsequently be unreachable--you will only have access to configure this Splunk instance via the CLI.
Note: Don't forget to install either the free, or forwarder license.


Configure a Splunk instance as a forwarder via the CLI

To enable a Splunk forwarder or light forwarder via the CLI: 

./splunk enable app [SplunkForwarder|SplunkLightForwarder] -auth <username>:<password>

To determine what type of forwarder a particular Splunk instance is, run the following command: 

./splunk display app -auth <username>:<password>

Note: Don't forget to install either the free, or forwarder license.
Note: If you are running Splunk with a free license, you do not have to provide a username and password to enable apps.

Disable a Splunk forwarder or light forwarder via the CLI

To disable Splunk forwarder or light forwarder via the CLI: 

./splunk disable app [SplunkForwarder|SplunkLightForwarder] -auth <username>:<password>

Note: If you are running Splunk with a Free license, you do not have to provide a username and password.

Add or remove existing forwarders via the CLI

Enable forwarding from the Splunk CLI. Navigate to your $SPLUNK_HOME/bin directory on the forwarding server and log in to the CLI. 

./splunk login
Splunk username: admin
Password:

To add a forwarder: 

# ./splunk add forward-server <host:port> -auth admin:changeme

where <host:port> are the hostname and port of the Splunk server to which this forwarder or light forwarder should send data.

To remove an existing forwarder: 

# ./splunk remove forward-server <host:port> -auth admin:changeme

where <host:port> are the hostname and port of the Splunk server to which this forwarder or light forwarder is currently sending data.

Note: Although this command disables the forwarding activity, this machine will still be configured as a Splunk forwarder or light forwarder.

Retrieved from "http://docs.splunk.com/Documentation/Splunk/4.0.2/Admin/Setupforwarding"

This documentation applies to the following versions of Splunk: 4.0 , 4.0.1 , 4.0.2 , 4.0.3 , 4.0.4 , 4.0.5 , 4.0.6 , 4.0.7 , 4.0.8 , 4.0.9 , 4.0.10 , 4.0.11 View the Article History for its revisions.


You must be logged into splunk.com in order to post comments. Log in now.

Was this documentation topic helpful?

If you'd like to hear back from us, please provide your email address:

We'd love to hear what you think about this topic or the documentation as a whole. Feedback you enter here will be delivered to the documentation team.

Feedback submitted, thanks!