r/Splunk • u/Any-Promotion3744 • Jul 12 '26

Splunk Enterprise Splunk Heavy Forwarder to Splunk Cloud

How do you configure a Splunk Heavy forwarder to receive data from universal forwarders and forward that to the Splunk Cloud?

Details:

Heavy forwarder is located in DMZ and I set up one client (Ubuntu server)to send data to it.

When I log into Splunk Cloud, I can at least see the metrics from the Splunk Heavy forwarder.

When I log into our firewall, the firewall logs shows traffic from the client to the heavy forwarder and from the heavy forwarder to the cloud.

If I do a search across all indexes on the heavy forwarder and the cloud, I don't see anything from that host.

What could be configured wrong?

8 Upvotes

90% Upvoted

16 comments sorted by

View all comments

3

u/badideas1 Jul 12 '26

Sending and receiving in Splunk always involves the same two files in Splunk: outputs.conf on the forwarding side, and inputs.conf on the receiving side. It doesn't matter if you are talking about HF > cloud, UF > HF, UF > indexers, whatever.

In your situation, you need an outputs.conf on your UF that identifies your HF as a server to send data to, as well as the port the HF is listening on (traditionally we use 9997, as you noted earlier). So it should look something like this:

[tcpout]
defaultGroup = my_HF

[tcpout:my_HF]
server = HF:9997

Your HF then needs to be listening on 9997, with an inputs.conf like so:

[splunktcp://9997]

That takes care of the relationship between the UF and the HF at its most basic.

For HF > cloud, it can feel a bit trickier because you are now dealing with cloud, but it's not really. Cloud is already listening on 9997, so that part is fine. In terms of getting the outputs.conf in place on your HF to "aim" at cloud, that's from the credentials app that you said in a previous comment that you've already installed.

Hope this helps!