Deploy a heavy forwarder

You can enable a heavy forwarder on a full Splunk Enterprise instance. Enabling a heavy forwarder lets you perform all of the other tasks that the indexer is capable of, such as indexing, data routing, and transformation. This is unlike a universal forwarder, which can't index data at all and has limited data manipulation capability as a result of its reduced footprint.

To enable forwarding and receiving, you must configure both a receiver and a forwarder. The receiver is the Splunk instance that receives the data; the forwarder sends data to the receiver. The receiver must be another Splunk Enterprise instance, you can't forward data to the same machine unless that machine has another Splunk Enterprise instance running on it.

A Splunk best practice is to set up the receiver first, as described in Enable a receiver. You can then set up forwarders to send data to that receiver.

Setting up a heavy forwarder is a two step process:

1. Install a full Splunk Enterprise instance.
2. Enable forwarding on the instance.

There isn't an option to install a heavy forwarder.

Set up forwarding

You can use Splunk Web or the Splunk CLI to enable forwarding for a Splunk Enterprise instance.

You can also enable, as well as configure, forwarding by creating an outputs.conf file on the Splunk instance. Although setting up forwarders with outputs.conf requires more initial knowledge, there are advantages to performing all forwarder configurations in a single location. Most advanced configuration options are available only through outputs.conf. In addition, if you enable and configure a number of forwarders, you can easily accomplish this by editing a single outputs.conf file and making a copy for each forwarder. See Configure forwarders with outputs.conf for more information.

Set up heavy forwarding with Splunk Web

1. Log into Splunk Web as an administrative user on the instance that is to forward data.
2. Select Settings > Forwarding and receiving.
3. Select Add new at Configure forwarding.
4. Enter the host name or IP address for the receiving Splunk instance, along with the receiving port that you specified when you configured the receiver. For example, you might enter: receivingserver.com:9997. To implement load-balanced forwarding, you can enter multiple hosts as a comma-separated list.
5. Select Save.

Configure heavy forwarders to index and forward data

A heavy forwarder has an advantage over light and universal forwarders in that it can index your data locally, as well as forward the data to another index. Local indexing is turned off by default. If you want to store data on the forwarder, you must enable that capability, either as described in "Set up heavy forwarding with Splunk Web" earlier in this topic, or by editing the outputs.conf configuration file, which controls forwarding outputs.

1. Log into Splunk Web as an administrative user on the instance that is to forward data.
2. Select Settings > Forwarding and receiving.
3. Select Forwarding defaults.
4. Select Yes to store and maintain a local copy of the indexed data on the forwarder.

You must perform any further configuration of forwarding while indexing in the outputs.conf file.

Set up heavy forwarding with the CLI

With the CLI, enable forwarding on the Splunk Enterprise instance as follows, then configure forwarding to a specified receiver.

1. From a command or shell prompt, navigate to the $SPLUNK_HOME/bin/ directory.
2. Type in the following to enable forwarding:

   splunk enable app SplunkForwarder -auth <username>:<password>
   

3. Restart Splunk Enterprise.

Start forwarding activity from the CLI

The following procedure sends data to the receiving indexer that you specify. Before you can send data to a receiver,

1. From a shell or command prompt, go to the $SPLUNK_HOME/bin directory.
2. Specify the receiver with the splunk add forward-server command:

   splunk add forward-server <host>:<port> -auth <username>:<password>
   

3. After invoking either of these commands, restart the forwarder.

Stop forwarding activity from the CLI

To end forwarding activity, enter:

splunk remove forward-server <host>:<port> -auth <username>:<password>

Disable forwarding from the CLI

Even if you stop forwarding activity, the instance remains configured as a forwarder. To revert the forwarder to a full Splunk Enterprise instance, use the disable command, as described earlier in this topic.

1. From a command or shell prompt, go to the $SPLUNK_HOME/bin directory.
2. Type in the following to disable forwarding:

   splunk disable app SplunkForwarder -auth <username>:<password>
   

By disabling forwarding, this command reverts the forwarder to a full Splunk Enterprise instance.