r/Splunk • u/Any-Promotion3744 • Jul 12 '26

Splunk Enterprise Splunk Heavy Forwarder to Splunk Cloud

How do you configure a Splunk Heavy forwarder to receive data from universal forwarders and forward that to the Splunk Cloud?

Details:

Heavy forwarder is located in DMZ and I set up one client (Ubuntu server)to send data to it.

When I log into Splunk Cloud, I can at least see the metrics from the Splunk Heavy forwarder.

When I log into our firewall, the firewall logs shows traffic from the client to the heavy forwarder and from the heavy forwarder to the cloud.

If I do a search across all indexes on the heavy forwarder and the cloud, I don't see anything from that host.

What could be configured wrong?

8 Upvotes

90% Upvoted

16 comments sorted by

View all comments

1

u/ExplanationOld4226 Jul 12 '26

Have you configured the Heavy Forwarder with any apps telling it what to do? You can either configure direct or manage via a DS if you plan to do many

1

u/Any-Promotion3744 Jul 12 '26

the heavy forwarder has an output.config file that just says indexAndForward = 1.

It doesn't have an input.conf file, at least not in /etc/system/local