Hi
Need advice on the following inquires:
Scenario:
What part are you struggling with? This is achieved by adding a monitor on the UDP port (http://docs.splunk.com/Documentation/Splunk/latest/Data/Monitornetworkports ) and adding a forward server (http://docs.splunk.com/Documentation/Splunk/latest/Deploy/Deployaforwarder ).