Getting Data In

how can i configure my search head to get the data from a heavy forwarder?

pavanae
Builder

I am aware of getting the data from an universal forwarder?. Can anyone explain me the process of getting data from a heavy forwarder?

I would really appreciate if anyone can explain the step by step process of getting the data..

My splunk search head is in stand alone environment.

1 Solution

richgalloway
SplunkTrust
SplunkTrust

The first step is to enable receiving in your search head/indexer. Select Settings->Forwarding and Receiving then click "Add New" in the "Receive data" section. Use port 9997 for your first listener.
The second step is to enable forwarding in the HF. Select Settings->Forwarding and Receiving then click "Add New" in the "Forward data" section. Enter the host name or IP address of your search head along with the port number entered above.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

gcusello
SplunkTrust
SplunkTrust
0 Karma

richgalloway
SplunkTrust
SplunkTrust

The first step is to enable receiving in your search head/indexer. Select Settings->Forwarding and Receiving then click "Add New" in the "Receive data" section. Use port 9997 for your first listener.
The second step is to enable forwarding in the HF. Select Settings->Forwarding and Receiving then click "Add New" in the "Forward data" section. Enter the host name or IP address of your search head along with the port number entered above.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...