intermediate forwarder

intermediate forwarder

noun

A forwarder that you have configured to receive data from one or more forwarders and subsequently send that data to either an indexer or another forwarder.

Setting up an intermediate forwarder is useful when:

• Network bandwidth between geographical locations is limited.
• You want to transform any data before sending it to an indexer without having the final receiving indexer do any of the transforming work.
• You want to isolate how data flows between certain environments.

All forwarder types can act as intermediate forwarders.

For more information

In the Splunk Enterprise Forwarding Data Manual:

• Configure an intermediate forwarder