Splunk® Enterprise

Forwarding Data

Splunk Enterprise version 7.2 is no longer supported as of April 30, 2021. See the Splunk Software Support Policy for details. For information about upgrading to a supported version, see How to upgrade Splunk Enterprise.
This documentation does not apply to the most recent version of Splunk® Enterprise. For documentation on the most recent version, go to the latest release.

Enable forwarding on a Splunk Enterprise instance

A Splunk Enterprise instance can be configured to forward data to another instance of Splunk Enterprise. This is used primarily for:

  • Forwarding logs from local data sources and sending them to the indexers.
  • Forwarding Splunk Enterprise internal logs from the search heads or other supporting roles to the indexers in a distributed or clustered environment.
  • Establishing an intermediate forwarder layer with heavy or universal forwarders. These intermediate forwarders act as an aggregation and routing layer, consolidating incoming data streams from many forwarders and sending the events out to other forwarders or indexers.


Set up forwarding

  1. Determine which Splunk Enterprise instance will forward data.
  2. Collect the list of the receivers (other forwarders or indexers) the instances are communicating with.
  3. On the forwarding instance, use Splunk Web or the CLI commands to configure and enable forwarding. See Deploy a heavy forwarder.
  4. (Optional) Use the deployment server to configure and enable forwarding through an app. See Configure deployment clients in the Updating Splunk Enterprise Instances manual.
  5. (Optional) On the indexers, search the _internal index for data to confirm that forwarding was successful. For example:

    index=_internal host=<forwarder host name>

  6. (Optional) If you intend the forwarding instance to be an intermediate forwarder and accept incoming data streams from other forwarders, configure receiving. See Enable a receiver.

Enable forwarding on a universal forwarder instance

If you're looking for the universal forwarder instructions, see Deploy the universal forwarder in the Forwarder manual.

Last modified on 04 April, 2022
Compatibility between forwarders and indexers   Heavy and light forwarder capabilities

This documentation applies to the following versions of Splunk® Enterprise: 7.1.0, 7.1.1, 7.1.2, 7.1.3, 7.1.4, 7.1.5, 7.1.6, 7.1.7, 7.1.8, 7.1.9, 7.1.10, 7.2.0, 7.2.1, 7.2.2, 7.2.3, 7.2.4, 7.2.5, 7.2.6, 7.2.7, 7.2.8, 7.2.9, 7.2.10, 7.3.0, 7.3.1, 7.3.2, 7.3.3, 7.3.4, 7.3.5, 7.3.6, 7.3.7, 7.3.8, 7.3.9, 8.0.0, 8.0.1, 8.0.2, 8.0.3, 8.0.4, 8.0.5, 8.0.6, 8.0.7, 8.0.8, 8.0.9, 8.0.10, 8.1.0, 8.1.1, 8.1.2, 8.1.3, 8.1.4, 8.1.5, 8.1.6, 8.1.7, 8.1.8, 8.1.9, 8.1.10, 8.1.11, 8.1.12, 8.1.13, 8.1.14, 8.2.0, 8.2.1, 8.2.2, 8.2.3, 8.2.4, 8.2.5

Acrobat logo Download manual
Acrobat logo Download this page

Was this topic useful?







You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters