splunk forwarder showing different events indexed than splunk indexer

remy06 — Tue, 27 Jul 2010 09:23:11 GMT

Hi,

Just to check, I've a splunk forwarder that shows lesser events indexed than on the splunk indexer.Is it suppose to be like this?

For eg, on a windows server I've this forwarder installed and configured to send winevent logs to splunk indexer. The forwarder itself shows 26,434 events indexed while on the splunk indexer shows 253,118.

I've configured forwarding defaults NOT to store a local copy of forwarded events so has it got anything to do with this?

Re: splunk forwarder showing different events indexed than splunk indexer

e82than — Tue, 27 Jul 2010 11:34:03 GMT

hi remy06,

By not getting your fowarder to keep a copy of the data, the results differ.

"I've configured forwarding defaults NOT to store a local copy of forwarded events so has it got anything to do with this?"

R, Ethan Hunt.

topic splunk forwarder showing different events indexed than splunk indexer in Getting Data In

splunk forwarder showing different events indexed than splunk indexer

Re: splunk forwarder showing different events indexed than splunk indexer