Configure forwarding

You must forward the data collected from the FA VM to your indexers. Configure your forwarders to do this. For more information about setting up forwarding for your indexers, see Configure forwarders with outputs.conf in the Splunk Distributed Deployment Manual.

For a single indexer configuration:

1. Use the splunkadmin user to log into the FA VM and enter the following:

   splunk add forward-server <host>:<port>

   For example,

   splunk add forward-server splunkindexer.company.com:9997

2. Now enter the default Splunk credentials to log into the Splunk forwarder on the FA, or use the credentials you created for the FA. The default username is admin and the password is changeme.
3. Check that the indexer is active and that you can forward data to it. Run the command:

   splunk list forward-server.

4. The indexer to which you are forwarding data is added the list of active forward servers.