So something interesting I found out: you can configure universal forwarder relaying.
Basically one universal forwarder can relay data to another universal forwarder. Which in turn can relay data to an indexer.
I'm trying to set it up as practice. I have a basic output.conf on forwarder 1 ->
[tcpout]
defaultGroup = default-autolb-group
server = universal_forwarder_relay_IP:9997
[tcpout:default-autolb-group]
The UF Relay also has an input.conf that listens for connections coming from the 1st UF.
[default]
host = x.x.x.x
[splunktcp://1st_UF:xxx]
However I'm getting this output:
--splunk-cooked-mode-v3--\x00\x00\x00\x00\x00
I'm not sure why I'm getting this data and not the contents of the 1st forwarder. Any help is appreciated.
Hi @TitanAE,
You can do below configuration to achieve this
outputs.conf
[tcpout]
defaultGroup = intermediate_UF
[tcpout:intermediate_UF]
server = Intermediate_UF_IP:9997
inputs.conf
[splunktcp://9997]
connection_host = ip
outputs.conf
[tcpout]
defaultGroup = Indexers
[tcpout:Indexers]
server = Indexer_IP:9997
And after configuration changes restart splunk service on both Universal Forwarder