Enable forwarding on a Splunk Enterprise instance

A Splunk Enterprise instance can be configured to forward data to another instance of Splunk Enterprise. This is used primarily for:

• Forwarding logs from local data sources and sending them to the indexers.
• Forwarding Splunk Enterprise internal logs from the search heads or other supporting roles to the indexers in a distributed or clustered environment.
• Establishing an intermediate forwarder layer with heavy or universal forwarders. These intermediate forwarders act as an aggregation and routing layer, consolidating incoming data streams from many forwarders and sending the events out to other forwarders or indexers.

Set up forwarding

1. Determine which Splunk Enterprise instance will forward data.
2. Collect the list of the receivers (other forwarders or indexers) the instances are communicating with.
3. On the forwarding instance, use Splunk Web or the CLI commands to configure and enable forwarding. See Deploy a heavy forwarder.
4. (Optional) Use the deployment server to configure and enable forwarding through an app. See Configure deployment clients in the Updating Splunk Enterprise Instances manual.
5. (Optional) On the indexers, search the _internal index for data to confirm that forwarding was successful. For example:

   index=_internal host=<forwarder host name>

6. (Optional) If you intend the forwarding instance to be an intermediate forwarder and accept incoming data streams from other forwarders, configure receiving. See Enable a receiver.

Enable forwarding on a universal forwarder instance

If you're looking for the universal forwarder instructions, see Deploy the universal forwarder in the Forwarder manual.