Hello, i'm triing to use an UF to forward HEC from internet data to another UF in our DMZ look like : httplistner input (UF1) httpout output  --> httplistner input (UF2 in DMZ) S2S output --> Splunk enterprise in lan if i curl both of http listener i got success,  curl -k -u "x:TOKEN" "https://UF1:8088/services/collector/event" -d '{"event": "Hello, world!"}' {"text":"Success","code":0} curl -k -u "x:TOKEN" "https://UF2:8088/services/collector/event" -d '{"event": "Hello, world!"}' {"text":"Success","code":0} But i got events in my splunk indexeur only on the second curl, the first one look like the output never forward to the UF2...  Nothing in both uf1-2 logs about errors.  My /opt/splunkforwarder/etc/system/local/outputs.conf on UF1 look like: [tcpout] defaultGroup = default-autolb-group disabled = 1 [httpout] disabled = 0 httpEventCollectorToken = MYTOKEN uri = https://UF2-IP:8088 batchSize = 65536 batchTimeout = 5   Thks for help !! Flo V. ... View more