Splunk® Universal Forwarder

Forwarder Manual

This documentation does not apply to the most recent version of Splunk® Universal Forwarder. For documentation on the most recent version, go to the latest release.

Configure an intermediate forwarder

Intermediate forwarding is where a forwarder receives data from one or more forwarders and then sends that data on to another indexer. This kind of setup is useful when, for example, you have many hosts in different geographical regions and you want to send data from those forwarders to a central host in that region before forwarding the data to an indexer. All forwarder types can act as an intermediate forwarder.

Configure intermediate forwarding

Set up the intermediate forwarding tier

  1. Install the forwarder on your intermediate host.
  2. Configure the intermediate forwarder to send data to a receiving indexer. See Configure the forwarder.
    1. If you install the forwarder on Windows, you can specify the receiving indexer during the installation process.
  3. Configure the intermediate forwarder to receive data. See Configure a receiver using a configuration file.
  4. (Optional) Configure any local data inputs on the intermediate forwarder. See Configure local data inputs.
  5. Restart the forwarder services.

You can repeat these steps to add more forwarders to the intermediate tier.

Configure forwarders to use the intermediate forwarding tier

  1. Install the universal forwarder.
  2. Configure the forwarder to send data to the intermediate forwarder. In this scenario, the intermediate forwarder acts as the receiver.
  3. Configure local data inputs on the forwarder.
  4. Restart the forwarder services.

Test the configuration

  1. In Splunk Web, log into your Splunk deployment.
  2. Open the Search and Reporting app.
  3. Run a search that contains a reference to one of the hosts that you configured to send data to the intermediate forwarder

    host=<name or ip address of forwarder> index=_internal


    If you do not see events, then the host has not been configured properly. See Troubleshoot the universal forwarder for possible fixes.
Last modified on 01 December, 2021
Configure a forwarder to use a SOCKS proxy   Configure a forwarder to handle multiple pipeline sets

This documentation applies to the following versions of Splunk® Universal Forwarder: 7.0.0, 7.0.1, 7.0.2, 7.0.3, 7.0.4, 7.0.5, 7.0.6, 7.0.7, 7.0.8, 7.0.9, 7.0.10, 7.0.11, 7.0.13, 7.1.0, 7.1.1, 7.1.2, 7.1.3, 7.1.4, 7.1.5, 7.1.6, 7.1.7, 7.1.8, 7.1.9, 7.1.10, 7.2.0, 7.2.1, 7.2.2, 7.2.3, 7.2.4, 7.2.5, 7.2.6, 7.2.7, 7.2.8, 7.2.9, 7.2.10, 7.3.0, 7.3.1, 7.3.2, 7.3.3, 7.3.4, 7.3.5, 7.3.6, 7.3.7, 7.3.8, 7.3.9, 8.0.0, 8.0.1, 8.0.2, 8.0.3, 8.0.4, 8.0.5, 8.0.6, 8.0.7, 8.0.8, 8.0.9, 8.0.10, 8.1.0, 8.1.1, 8.1.2, 8.1.3, 8.1.4, 8.1.5, 8.1.6, 8.1.7, 8.1.8, 8.1.9, 8.1.10, 8.1.11, 8.1.12, 8.1.13, 8.1.14, 8.2.0, 8.2.1, 8.2.2, 8.2.3

Acrobat logo Download manual
Acrobat logo Download this page

Was this topic useful?







You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters