![Acrobat logo](/skins/OxfordComma/images/acrobat-logo.png)
Configure an intermediate forwarder
Intermediate forwarding is where a forwarder receives data from one or more forwarders and then sends that data on to another indexer. This kind of setup is useful when, for example, you have many hosts in different geographical regions and you want to send data from those forwarders to a central host in that region before forwarding the data to an indexer. All forwarder types can act as an intermediate forwarder.
Configure intermediate forwarding
Set up the intermediate forwarding tier
- Install the forwarder on your intermediate host.
- Configure the intermediate forwarder to send data to a receiving indexer. See Configure the forwarder.
- If you install the forwarder on Windows, you can specify the receiving indexer during the installation process.
- Configure the intermediate forwarder to receive data. See Configure a receiver using a configuration file.
- (Optional) Configure any local data inputs on the intermediate forwarder. See Configure local data inputs.
- Restart the forwarder services.
You can repeat these steps to add more forwarders to the intermediate tier.
Configure forwarders to use the intermediate forwarding tier
- Install the universal forwarder.
- Configure the forwarder to send data to the intermediate forwarder. In this scenario, the intermediate forwarder acts as the receiver.
- Configure local data inputs on the forwarder.
- Restart the forwarder services.
Test the configuration
- In Splunk Web, log into your Splunk deployment.
- Open the Search and Reporting app.
- Run a search that contains a reference to one of the hosts that you configured to send data to the intermediate forwarder
host=<name or ip address of forwarder> index=_internal
If you do not see events, then the host has not been configured properly. See Troubleshoot the universal forwarder for possible fixes.
PREVIOUS Configure a forwarder to use a SOCKS proxy |
NEXT Configure a forwarder to handle multiple pipeline sets |
This documentation applies to the following versions of Splunk® Universal Forwarder: 7.0.0, 7.0.1, 7.0.2, 7.0.3, 7.0.4, 7.0.5, 7.0.6, 7.0.7, 7.0.8, 7.0.9, 7.0.10, 7.0.11, 7.0.13, 7.1.0, 7.1.1, 7.1.2, 7.1.3, 7.1.4, 7.1.5, 7.1.6, 7.1.7, 7.1.8, 7.1.9, 7.1.10, 7.2.0, 7.2.1, 7.2.2, 7.2.3, 7.2.4, 7.2.5, 7.2.6, 7.2.7, 7.2.8, 7.2.9, 7.2.10, 7.3.0, 7.3.1, 7.3.2, 7.3.3, 7.3.4, 7.3.5, 7.3.6, 7.3.7, 7.3.8, 7.3.9, 8.0.0, 8.0.1, 8.0.2, 8.0.3, 8.0.4, 8.0.5, 8.0.6, 8.0.7, 8.0.8, 8.0.9, 8.0.10, 8.1.0, 8.1.1, 8.1.2, 8.1.3, 8.1.4, 8.1.5, 8.1.6, 8.1.7, 8.1.8, 8.1.9, 8.1.10, 8.1.11, 8.1.12, 8.1.13, 8.1.14, 8.2.0, 8.2.1, 8.2.2, 8.2.3
Feedback submitted, thanks!