Deploy a heavy forwarder

You can enable a heavy forwarder on a full Splunk Enterprise instance

To enable forwarding and receiving, you must configure both a receiver and a forwarder. The receiver is the Splunk instance that receives the data; the forwarder sends data to the receiver.

A Splunk best practice is to set up the receiver first, as described in Enable a receiver. You can then set up forwarders to send data to that receiver.

Setting up a heavy forwarder is a two step process:

1. Install a full Splunk Enterprise instance.

2. Enable forwarding on the instance.

Set up forwarding

You can use Splunk Web or the CLI to enable forwarding for a Splunk instance.

You can also enable, as well as configure, forwarding by creating an outputs.conf file on the Splunk instance. Although setting up forwarders with outputs.conf requires more initial knowledge, there are advantages to performing all forwarder configurations in a single location. Most advanced configuration options are available only through outputs.conf. In addition, if you enable and configure a number of forwarders, you can easily accomplish this by editing a single outputs.conf file and making a copy for each forwarder. See Configure forwarders with outputs.conf for more information.

Set up heavy forwarding with Splunk Web

1. Log into Splunk Web as admin on the instance that will be forwarding data.

2. Click the Settings > Forwarding and receiving.

3. Click Add new at Configure forwarding.

4. Enter the hostname or IP address for the receiving Splunk instance(s), along with the receiving port specified when the receiver was configured. For example, you might enter: receivingserver.com:9997. To implement load-balanced forwarding, you can enter multiple hosts as a comma-separated list.

5. Click Save.

Configure heavy forwarders to index and forward data

A heavy forwarder has a key advantage over light and universal forwarders in that it can index your data locally, as well as forward the data to another index. However, local indexing is turned off by default. If you want to store data on the forwarder, you must enable that capability - either in the manner described above or by editing outputs.conf.

1. Log into Splunk Web as admin on the instance that will be forwarding data.

2. Click the Settings > Forwarding and receiving.

3. Select Forwarding defaults.

4. Select Yes to store and maintain a local copy of the indexed data on the forwarder.

All other configuration must be done in outputs.conf.

Set up heavy forwarding with the CLI

With the CLI, enable forwarding on the Splunk Enterprise instance as follows, then configure forwarding to a specified receiver.

1. From a command or shell prompt, navigate to $SPLUNK_HOME/bin/.

2. Type in the following to enable forwarding:

splunk enable app SplunkForwarder -auth <username>:<password>

3. Restart Splunk Enterprise.

Start forwarding activity from the CLI

The following procedure sends data to the receiving indexer that you specify. Before you can send data to a receiver,

1. From a shell or command prompt, go to the $SPLUNK_HOME/bin directory.

2. To start forwarding activity, specify the receiver with the splunk add forward-server command:

splunk add forward-server <host>:<port> -auth <username>:<password>

3. After invoking either of these commands, restart the forwarder.

Stop forwarding activity from the CLI

To end forwarding activity, enter:

splunk remove forward-server <host>:<port> -auth <username>:<password>

Disable forwarding from the CLI

Even if you stop forwarding activity, the instance remains configured as a forwarder. To revert the forwarder to a full Splunk Enterprise instance, use the disable command, as described earlier in this topic.

1. From a command or shell prompt, go to the $SPLUNK_HOME/bin directory.

2. Type in the following to disable forwarding:

splunk disable app SplunkForwarder -auth <username>:<password>

By disabling forwarding, this command reverts the forwarder to a full Splunk Enterprise instance.