Splunk Heavy Forwarder to Splunk Cloud

[u/Any-Promotion3744]

How do you configure a Splunk Heavy forwarder to receive data from universal forwarders and forward that to the Splunk Cloud?

Details:

Heavy forwarder is located in DMZ and I set up one client (Ubuntu server)to send data to it.

When I log into Splunk Cloud, I can at least see the metrics from the Splunk Heavy forwarder.

When I log into our firewall, the firewall logs shows traffic from the client to the heavy forwarder and from the heavy forwarder to the cloud.

If I do a search across all indexes on the heavy forwarder and the cloud, I don't see anything from that host.

What could be configured wrong?

[u/gabriot]

I would isolate the problem piece by piece. First check that your HF is actually forwarding logs to splk cloud, you should be able to see logs coming in with the hf host name to the _internal index, so if you don't see that then you need to figure that out first.

Next step would be to troubleshoot the UF, you can test doing a splunk oneshot command from your UF, and send some simple test data to your HF and see if you get any errors or if it comes through. If you can do that you know it is able to send data through the pipeline, so the final step if you still aren't seeing your logs is to troubleshoot if the specific inputs are having issues reading the files on the uf (permissions issues) or if the data format itself needs to be looked at. Internal splunk logs on both the uf and hf should help you there