https://community.splunk.com/t5/Deployment-Architecture/automatic-lookup-on-splunkforwarder/m-p/258193#M9812 <P>The Universal Forwarder only forwards. To do anything else, you must install a Heavy Forwarder.</P> Mon, 30 Nov 2015 17:54:20 GMT richgalloway 2015-11-30T17:54:20Z https://community.splunk.com/t5/Deployment-Architecture/automatic-lookup-on-splunkforwarder/m-p/258192#M9811 <P>Hello,</P> <P>is it possible, to implement automatic lookups on a splunk forwarder?<BR /> The reason for this request is, that i´ve already installed the splunk forwarder on a linux-based vpn-server.<BR /> The forwarder already monitors the log file of the vpn-process (racoon) and forward it to our central splunk indexer.<BR /> But there is a need, to add data to the logfile, befor it is send to the indexer, because the data which has to be added are only available at run-time on the linux system itself and depends on the information of each log line. Therefor i´ve no chance with an lookup at the central splunk indexer.</P> <P>regards<BR /> Michael</P> Mon, 30 Nov 2015 15:10:49 GMT https://community.splunk.com/t5/Deployment-Architecture/automatic-lookup-on-splunkforwarder/m-p/258192#M9811 mbrussk 2015-11-30T15:10:49Z https://community.splunk.com/t5/Deployment-Architecture/automatic-lookup-on-splunkforwarder/m-p/258193#M9812 <P>The Universal Forwarder only forwards. To do anything else, you must install a Heavy Forwarder.</P> Mon, 30 Nov 2015 17:54:20 GMT https://community.splunk.com/t5/Deployment-Architecture/automatic-lookup-on-splunkforwarder/m-p/258193#M9812 richgalloway 2015-11-30T17:54:20Z