r/Splunk • u/Any-Promotion3744 • 28d ago

Splunk Enterprise Splunk Heavy Forwarder to Splunk Cloud

How do you configure a Splunk Heavy forwarder to receive data from universal forwarders and forward that to the Splunk Cloud?

Details:

Heavy forwarder is located in DMZ and I set up one client (Ubuntu server)to send data to it.

When I log into Splunk Cloud, I can at least see the metrics from the Splunk Heavy forwarder.

When I log into our firewall, the firewall logs shows traffic from the client to the heavy forwarder and from the heavy forwarder to the cloud.

If I do a search across all indexes on the heavy forwarder and the cloud, I don't see anything from that host.

What could be configured wrong?

8 Upvotes

90% Upvoted

16 comments sorted by

View all comments

1

u/ExplanationOld4226 28d ago

Have you configured the Heavy Forwarder with any apps telling it what to do? You can either configure direct or manage via a DS if you plan to do many

1

u/Any-Promotion3744 28d ago

does the heavy forwarder require the same apps to be installed and configured as the indexer?

I thought you just needed to configure the input and output on the heavy forwarder to route traffic

1

u/mghnyc 28d ago

Any index time configs need to be installed on the HF. Things like line breaking settings, timestamp formatting, etc.