Forwarding Data

Question 1

Can universal forwarder index data

Answer 1

No

Question 2

What heavy forwarder can do

Answer 2

Heavy forwarder allows you to perform all if other tasks that indexer is capable of including indexing, data routing and transformation

Question 3

Setting up Geary forwarder process

Answer 3

Install full Splunk Enerprise
Enable forwarding on the instance

Question 4

Ways to setup forwarding

Answer 4

Splunk Web
Splunk CLI
Create and configure outputs conf

Question 5

Setup heavy forwarder process

Answer 5

Settings > Forwarding and receiving > Add new > Configure forwarding > ip of receiving splunk instance and receiving port

For load balancing can add multiple hosts as comma separated list

Question 6

Configure heavy forwarder to index and forward data

Answer 6

Settings > Forwarding and Receiving > Forwarding defaults

Additional configuration from outputs.conf

Question 7

Setup heavy forwarding via CLI

Answer 7

$SPLUNK_HOME/bin/

splunk enable app SplunkForwarder -auth username:password

Restart splunk

Question 8

Start forwarding from CLI

Answer 8

$SPLUNK_HOME/bin/

splunk add forward-server host:port -auth username:password