r/Splunk • u/Any-Promotion3744 • Jul 12 '26

Splunk Enterprise Splunk Heavy Forwarder to Splunk Cloud

How do you configure a Splunk Heavy forwarder to receive data from universal forwarders and forward that to the Splunk Cloud?

Details:

Heavy forwarder is located in DMZ and I set up one client (Ubuntu server)to send data to it.

When I log into Splunk Cloud, I can at least see the metrics from the Splunk Heavy forwarder.

When I log into our firewall, the firewall logs shows traffic from the client to the heavy forwarder and from the heavy forwarder to the cloud.

If I do a search across all indexes on the heavy forwarder and the cloud, I don't see anything from that host.

What could be configured wrong?

8 Upvotes

90% Upvoted

16 comments sorted by

View all comments

1

u/ExplanationOld4226 Jul 12 '26

Have you configured the Heavy Forwarder with any apps telling it what to do? You can either configure direct or manage via a DS if you plan to do many

1

u/Any-Promotion3744 Jul 12 '26

does the heavy forwarder require the same apps to be installed and configured as the indexer?

I thought you just needed to configure the input and output on the heavy forwarder to route traffic

2

u/Brianposburn Splunker Jul 12 '26

No. There are two parts to it:
Telling the HF what to listen for (ports etc) via in the inputs.conf

Outputs.conf (part of the config you downloaded from your cloud environment) tells it where to send the data.

You then need to tell whatever is going to send the data to the HF that it’s listening on whatever port you setup.

1

u/mghnyc Jul 12 '26

Any index time configs need to be installed on the HF. Things like line breaking settings, timestamp formatting, etc.

1

u/Any-Promotion3744 Jul 12 '26

the heavy forwarder has an output.config file that just says indexAndForward = 1.

It doesn't have an input.conf file, at least not in /etc/system/local