
Deploy a heavy forwarder
You can enable a heavy forwarder on a full Splunk Enterprise instance
To enable forwarding and receiving, you must configure both a receiver and a forwarder. The receiver is the Splunk instance that receives the data; the forwarder sends data to the receiver.
A Splunk best practice is to set up the receiver first, as described in Enable a receiver. You can then set up forwarders to send data to that receiver.
Setting up a heavy forwarder is a two step process:
1. Install a full Splunk Enterprise instance.
2. Enable forwarding on the instance.
Set up forwarding
You can use Splunk Web or the CLI to enable forwarding for a Splunk instance.
You can also enable, as well as configure, forwarding by creating an outputs.conf
file on the Splunk instance. Although setting up forwarders with outputs.conf
requires more initial knowledge, there are advantages to performing all forwarder configurations in a single location. Most advanced configuration options are available only through outputs.conf
. In addition, if you enable and configure a number of forwarders, you can easily accomplish this by editing a single outputs.conf
file and making a copy for each forwarder. See Configure forwarders with outputs.conf for more information.
Set up heavy forwarding with Splunk Web
1. Log into Splunk Web as admin on the instance that will be forwarding data.
2. Click the Settings > Forwarding and receiving.
3. Click Add new at Configure forwarding.
4. Enter the hostname or IP address for the receiving Splunk instance(s), along with the receiving port specified when the receiver was configured. For example, you might enter: receivingserver.com:9997.
To implement load-balanced forwarding, you can enter multiple hosts as a comma-separated list.
5. Click Save.
Configure heavy forwarders to index and forward data
A heavy forwarder has a key advantage over light and universal forwarders in that it can index your data locally, as well as forward the data to another index. However, local indexing is turned off by default. If you want to store data on the forwarder, you must enable that capability - either in the manner described above or by editing outputs.conf
.
1. Log into Splunk Web as admin on the instance that will be forwarding data.
2. Click the Settings > Forwarding and receiving.
3. Select Forwarding defaults.
4. Select Yes to store and maintain a local copy of the indexed data on the forwarder.
All other configuration must be done in outputs.conf.
Set up heavy forwarding with the CLI
With the CLI, enable forwarding on the Splunk Enterprise instance as follows, then configure forwarding to a specified receiver.
1. From a command or shell prompt, navigate to $SPLUNK_HOME/bin/
.
2. Type in the following to enable forwarding:
splunk enable app SplunkForwarder -auth <username>:<password>
3. Restart Splunk Enterprise.
Start forwarding activity from the CLI
The following procedure sends data to the receiving indexer that you specify. Before you can send data to a receiver,
1. From a shell or command prompt, go to the $SPLUNK_HOME/bin
directory.
2. To start forwarding activity, specify the receiver with the splunk add forward-server
command:
splunk add forward-server <host>:<port> -auth <username>:<password>
3. After invoking either of these commands, restart the forwarder.
Stop forwarding activity from the CLI
To end forwarding activity, enter:
splunk remove forward-server <host>:<port> -auth <username>:<password>
Disable forwarding from the CLI
Even if you stop forwarding activity, the instance remains configured as a forwarder. To revert the forwarder to a full Splunk Enterprise instance, use the disable
command, as described earlier in this topic.
1. From a command or shell prompt, go to the $SPLUNK_HOME/bin
directory.
2. Type in the following to disable forwarding:
splunk disable app SplunkForwarder -auth <username>:<password>
By disabling forwarding, this command reverts the forwarder to a full Splunk Enterprise instance.
PREVIOUS Enable a receiver |
NEXT Deploy a light forwarder |
This documentation applies to the following versions of Splunk Cloud Platform™: 8.1.2103, 8.2.2106, 8.2.2107, 8.2.2105, 8.2.2109, 8.2.2111, 8.2.2112, 8.2.2201 (latest FedRAMP release), 8.2.2202, 8.2.2203
Feedback submitted, thanks!