topic Re: can splunkd.log be forwarded from Heavy Forwarder to Indexer? in Getting Data In

can splunkd.log be forwarded from Heavy Forwarder to Indexer?

fernandoandre — Wed, 30 May 2012 10:06:21 GMT

I have a Heavy Forwarder (HF) and an Indexer.

I would like to forward splunkd.log from the Heavy Forwarder to Indexer in order to search this log without having to log in to the HF.

1 - How can I do this?

2 - If possible, can I also do it for Universal Forwarders (how?)?

3 - If I use [monitor://...splunkd.log] and forward it, this will index the file and count to licensing purposes...or not?

If I run: splunk list monitor

Splunk returns that this "splunkd.log" in being monitored (but not sent to Indexer).

Thanks

Re: can splunkd.log be forwarded from Heavy Forwarder to Indexer?

dshpritz — Wed, 30 May 2012 13:14:04 GMT

Yes, you can do this, but by default Splunk does not forward events from _internal. In the outputs.conf, you would turn off the filtering. So in the "tcpout" stanza:

[tcpout]

forwardedindex.filter.disable = true

Re: can splunkd.log be forwarded from Heavy Forwarder to Indexer?

fernandoandre — Wed, 30 May 2012 14:23:19 GMT

Thank you. I don't know how but I completely overlooked that attribute when reading it.

I have tested it at HF and works perfectly.

Re: can splunkd.log be forwarded from Heavy Forwarder to Indexer?

jchampagne — Wed, 20 Feb 2013 21:45:25 GMT

I've implemented this change, hoping to get the local splunk logs from my heavy forwarders into my main indexer. However, I'm still not seeing anything. After doing some more checking, I've noticed that the _internal index on the heavy forwarders has no events.

Why would my heavy forwarders not be indexing their splunk log files by default?

Re: can splunkd.log be forwarded from Heavy Forwarder to Indexer?

yanivdutt — Sat, 31 Oct 2015 00:10:32 GMT

Even I have same issue. Heavy forwarders are not forwarding _internal logs