Enable forwarding on a Splunk Enterprise instance

You can set up heavy and light forwarders on full Splunk Enterprise instances. To learn how to configure a universal forwarder to send data, see "Find additional information about the universal forwarder in the Universal Forwarder manual" later in this topic. The process is different on a universal forwarder.

Set up forwarding and receiving: heavy or light forwarders

For instructions on how to enable receiving on a Splunk Enterprise instance, see Enable a receiver. If you do not see data on the indexers after you enable forwarding and receiving, see Troubleshoot forwarder/receiver connection.

1. Designate hosts that will act as forwarders and receivers.
2. Install Splunk Enterprise on all of these hosts.
3. On each receiver, use Splunk Web or the CLI to enable receiving.
4. On each forwarder, use Splunk Web or the CLI to enable forwarding. See Deploy a heavy forwarder or Deploy a light forwarder.
5. On each forwarder, use Splunk Web or the CLI, or edit inputs.conf to specify data inputs.
6. On each forwarder, use Splunk Web or the CLI, or edit outputs.conf to specify where the forwarders should send data.
7. On each forwarder, restart Splunk Enterprise to commit the configuration changes and start forwarding.
8. On the receivers, search for data to confirm that forwarding occurs as you expect. For example:

host=<forwarder host name>

Set up the universal forwarder

The universal forwarder is a separate product with a separate installation package and documentation. See the Universal Forwarder manual for details about the universal forwarder software.

1. Designate hosts that will act as forwarders and receivers.
2. Install Splunk Enterprise on the receiver hosts.
3. On each receiver, use Splunk Web or the CLI to enable receiving.
4. Download the universal forwarder software for the operating system that the forwarder hosts run. For example, if the forwarder hosts run Windows, download the Windows universal forwarder.
5. Install the universal forwarder software on the forwarder hosts. If the hosts run Windows, you can configure parts of the universal forwarder during the installation.
6. After you install the universal forwarder, configure it to send data to a Splunk Enterprise, Splunk Light, or Splunk Cloud indexer.
7. Configure the data inputs that you want to forward.
8. Start the universal forwarder.
9. On the receivers, search for data to confirm that forwarding occurs as you expect. For example:

host=<forwarder host name>

Find additional information about the universal forwarder in the Universal Forwarder manual

The Universal Forwarder manual has detailed information on how to install, configure, and troubleshoot problems with the universal forwarder software. For detailed instructions on how to install the forwarder, see Install the universal forwarder software in the Universal Forwarder manual.