Forwarding Data

Deploy a heavy forwarder

To enable forwarding and receiving, you configure both a receiver and a forwarder. The receiver is the Splunk Enterprise instance receiving the data; the forwarder sends data to the receiver.

You must first set up the receiver, as described in "Enable a receiver". You can then set up forwarders to send data to that receiver.

Setting up a heavy forwarder is a two step process:

1. Install a full Splunk Enterprise instance.

2. Enable forwarding on the instance.

The sections that follow describe these steps in detail.

Important: This topic describes deployment and configuration issues specific to heavy forwarders. For information on how to deploy a universal forwarder, see "Universal forwarder deployment overview".

Install a full Splunk Enterprise instance

To deploy a heavy forwarder, you must first install a full Splunk Enterprise instance. For detailed information about installing Splunk Enterprise, including system requirements and licensing issues, see the Installation manual.

Once the instance has been installed, you can enable forwarder functionality on it.

Set up forwarding

You can use Splunk Web or the CLI as a quick way to enable forwarding in a Splunk Enterprise instance.

You can also enable, as well as configure, forwarding by creating an outputs.conf file on the Splunk Enterprise instance. Although setting up forwarders with outputs.conf requires a bit more initial knowledge, there are obvious advantages to performing all forwarder configurations in a single location. Most advanced configuration options are available only through outputs.conf. In addition, if you will be enabling and configuring a number of forwarders, you can easily accomplish this by editing a single outputs.conf file and making a copy for each forwarder. See the topic "Configure forwarders with outputs.conf" for more information.

Set up heavy forwarding with Splunk Web

You can use Splunk Web to set up a heavy forwarder:

1. Log into Splunk Web as admin on the server that will be forwarding data.

2. Click the Settings link at the top of the page.

3. Select Forwarding and receiving in the Data area.

4. Click Add new in the Forward data section.

5. Enter the hostname or IP address for the receiving Splunk Enterprise instance(s), along with the receiving port specified when the receiver was configured. For example, you might enter: receivingserver.com:9997. To implement load-balanced forwarding, you can enter multiple hosts as a comma-separated list.

6. Click Save. You must restart the instance to complete the process.

You can use Splunk Web to perform one other configuration. To store a copy of indexed data local to the forwarder:

1. From Forwarding and receiving, select Forwarding defaults.

2. Select Yes to store and maintain a local copy of the indexed data on the forwarder.

Important: A heavy forwarder has a key advantage over light and universal forwarders in that it can index your data locally, as well as forward the data to another index. However, local indexing is turned off by default. If you want to store data on the forwarder, you must enable that capability - either in the manner described above or by editing outputs.conf.

All other configuration must be done in outputs.conf.

Set up heavy forwarding with the CLI

With the CLI, setting up forwarding is a two step process. First you enable forwarding on the Splunk Enterprise instance. Then you start forwarding to a specified receiver.

To access the CLI, first navigate to $SPLUNK_HOME/bin/.

To enable the forwarder mode, enter:

splunk enable app SplunkForwarder -auth <username>:<password>

To disable the forwarder mode, enter:

splunk disable app SplunkForwarder -auth <username>:<password>

By disabling forwarding, this command reverts the fowarder to a full Splunk Enterprise instance.

Important: After invoking either of these commands, restart the forwarder.

Start forwarding activity from the CLI

To access the CLI, first navigate to $SPLUNK_HOME/bin/.

To start forwarding activity, specify the receiver with the splunk add forward-server command:

splunk add forward-server <host>:<port> -auth <username>:<password>

To end forwarding activity, enter:

splunk remove forward-server <host>:<port> -auth <username>:<password>

Note: Although this command ends forwarding activity, the instance remains configured as a forwarder. To revert the forwarder to a full Splunk Enterprise instance, use the disable command, as described earlier in this topic.

Important: After invoking either of these commands, restart the forwarder.

Upgrade a forwarder

To upgrade a forwarder to a new version, just upgrade the instance in the usual fashion. For details, read the upgrade section of the Installation manual.

Important: Before doing an upgrade, consider whether you really need to. In many cases, there's no compelling reason to upgrade a forwarder. Forwarders are always compatible with later version indexers, so you do not need to upgrade them just because you've upgraded the indexers they're sending data to.

Back up your files first

Before you perform the upgrade, we strongly recommend that you back up all of your files. Most importantly, back up your Splunk Enterprise configuration files. For information on backing up configurations, read "Back up configuration information" in the Admin manual.

If you're upgrading a heavy forwarder that's indexing data locally, you also need to back up the indexed data. For information on backing up data, read "Back up indexed data" in the Managing Indexers and Clusters of Indexers manual.

You cannot downgrade to a previous version; if you need to revert to an older forwarder release, reinstall the instance.