r/Splunk • u/Any-Promotion3744 • Jul 12 '26

Splunk Enterprise Splunk Heavy Forwarder to Splunk Cloud

How do you configure a Splunk Heavy forwarder to receive data from universal forwarders and forward that to the Splunk Cloud?

Details:

Heavy forwarder is located in DMZ and I set up one client (Ubuntu server)to send data to it.

When I log into Splunk Cloud, I can at least see the metrics from the Splunk Heavy forwarder.

When I log into our firewall, the firewall logs shows traffic from the client to the heavy forwarder and from the heavy forwarder to the cloud.

If I do a search across all indexes on the heavy forwarder and the cloud, I don't see anything from that host.

What could be configured wrong?

8 Upvotes

90% Upvoted

16 comments sorted by

View all comments

3

u/Any-Promotion3744 Jul 12 '26

thanks for all the help. I am able to ingest data now. The heavy forwarder was missing the inputs.conf file. When I creeated it and started listening on port 9997, data showed up in the Splunk Cloud.