how can i configure my search head to get the data from a heavy forwarder?

[pavanae]

I am aware of getting the data from an universal forwarder?. Can anyone explain me the process of getting data from a heavy forwarder?

I would really appreciate if anyone can explain the step by step process of getting the data..

My splunk search head is in stand alone environment.

[gcusello]

see http://docs.splunk.com/Documentation/Forwarder/6.4.3/Forwarder/Abouttheuniversalforwarder
it's described the full process.
Bye.
Giuseppe

[richgalloway · Accepted solution]

The first step is to enable receiving in your search head/indexer. Select Settings->Forwarding and Receiving then click "Add New" in the "Receive data" section. Use port 9997 for your first listener.
The second step is to enable forwarding in the HF. Select Settings->Forwarding and Receiving then click "Add New" in the "Forward data" section. Enter the host name or IP address of your search head along with the port number entered above.