[splunk] heavy forwarder

$ splunk enable app SplunkForwarder -auth <username>:<password>
$ splunk add forward-server <host>:<port> -auth <username>:<password>