https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-install-a-Splunk-forwarder-on-centralized/m-p/188962#M37673 <P>How true! My fears are two-fold: 1) I'm indexing data that's not needed to shine light upon connections/patterns/etc and 2) I'd be excluding events/field values that I think aren't important, but actually are</P> <P>Considering using Hadoop on the backend to send all data to and then Hunk to search against the entire data set, but int he meantime re: using Splunk for real-time, proactive alerting I'd like to index only those relevant events/field values </P> Fri, 31 Oct 2014 15:04:30 GMT jwalzerpitt 2014-10-31T15:04:30Z https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-install-a-Splunk-forwarder-on-centralized/m-p/188946#M37657 <P>We use the nxlog agent on out Windows domain controllers/Exchange servers/IIS servers and forward to a centralized rsyslog server. </P> <P>Would it be possible to install the Splunk Forwarder on the centralized rsyslog server and filter the syslogs that would be forwarded from the centralized rsyslog server to our Splunk indexer to help filter out the unwanted events?</P> <P>Thx</P> Wed, 29 Oct 2014 20:51:22 GMT https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-install-a-Splunk-forwarder-on-centralized/m-p/188946#M37657 jwalzerpitt 2014-10-29T20:51:22Z https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-install-a-Splunk-forwarder-on-centralized/m-p/188947#M37658 <P>Yeah, provided you use a heavy forwarder instead of a universal forwarder.</P> <P>Note, you can have your indexer(s) filter data regardless of where it came from.</P> Wed, 29 Oct 2014 21:19:14 GMT https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-install-a-Splunk-forwarder-on-centralized/m-p/188947#M37658 martin_mueller 2014-10-29T21:19:14Z https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-install-a-Splunk-forwarder-on-centralized/m-p/188948#M37659 <P>Absolutely! We have a similar setup for the HA with heart beat setup. Like martin said, Heavy Forwarder only.</P> Thu, 30 Oct 2014 00:25:21 GMT https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-install-a-Splunk-forwarder-on-centralized/m-p/188948#M37659 Raghav2384 2014-10-30T00:25:21Z https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-install-a-Splunk-forwarder-on-centralized/m-p/188949#M37660 <P>Thx for the reply Martin</P> Thu, 30 Oct 2014 12:40:26 GMT https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-install-a-Splunk-forwarder-on-centralized/m-p/188949#M37660 jwalzerpitt 2014-10-30T12:40:26Z https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-install-a-Splunk-forwarder-on-centralized/m-p/188950#M37661 <P>Thx for the reply</P> Thu, 30 Oct 2014 12:40:48 GMT https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-install-a-Splunk-forwarder-on-centralized/m-p/188950#M37661 jwalzerpitt 2014-10-30T12:40:48Z https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-install-a-Splunk-forwarder-on-centralized/m-p/188951#M37662 <P>Martin,</P> <P>I assume for the rsyslog configuration, it's ok to log to a file, in which I would then configure the forwarded to forward the rsyslog log files to the Indexer, correct?</P> <P>Thx again</P> Thu, 30 Oct 2014 15:16:38 GMT https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-install-a-Splunk-forwarder-on-centralized/m-p/188951#M37662 jwalzerpitt 2014-10-30T15:16:38Z https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-install-a-Splunk-forwarder-on-centralized/m-p/188952#M37663 <P>Yup, having stuff written to a log file and then read by a forwarder with a regular <CODE>monitor://</CODE> stanza is good practice.</P> Thu, 30 Oct 2014 15:18:45 GMT https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-install-a-Splunk-forwarder-on-centralized/m-p/188952#M37663 martin_mueller 2014-10-30T15:18:45Z https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-install-a-Splunk-forwarder-on-centralized/m-p/188953#M37664 <P>Thx again </P> Thu, 30 Oct 2014 15:44:58 GMT https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-install-a-Splunk-forwarder-on-centralized/m-p/188953#M37664 jwalzerpitt 2014-10-30T15:44:58Z https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-install-a-Splunk-forwarder-on-centralized/m-p/188954#M37665 <P>Another one more question <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> <P>Is it possible to set the forwarder to be a black list and exclude events/logs that I don't want to be indexed, or does it only function as a white list?</P> <P>Thx again</P> Fri, 31 Oct 2014 14:26:42 GMT https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-install-a-Splunk-forwarder-on-centralized/m-p/188954#M37665 jwalzerpitt 2014-10-31T14:26:42Z https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-install-a-Splunk-forwarder-on-centralized/m-p/188955#M37666 <P>I don't quite grasp that sentence, could you elaborate on what you're trying to do?</P> <P>There's white/blacklisting on files in inputs.conf, filtering events on heavy forwarders, filtering events on indexers, routing entire files on either, ...</P> Fri, 31 Oct 2014 14:49:54 GMT https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-install-a-Splunk-forwarder-on-centralized/m-p/188955#M37666 martin_mueller 2014-10-31T14:49:54Z https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-install-a-Splunk-forwarder-on-centralized/m-p/188956#M37667 <P>Yes,HF,filter using props &amp; transform,send the ones you do not want to nullqueue. Again, like Martin mentioned below..</P> Fri, 31 Oct 2014 14:53:57 GMT https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-install-a-Splunk-forwarder-on-centralized/m-p/188956#M37667 Raghav2384 2014-10-31T14:53:57Z https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-install-a-Splunk-forwarder-on-centralized/m-p/188957#M37668 <P>I believe you have answered my poorly worded question. What I mean by blacklisting is say for example I want to prevent Windows Event ID 545 from being indexed, can I create a monitor:// stanza that excludes or prevents Windows Event ID 545 from being indexed? </P> <P>My fear was that I'd have to create monitor:// stanza for events I wanted to be indexed, but you stated there is blacklisting via filtering events so it appears I can filter out unneeded events so they don't get indexed.</P> Fri, 31 Oct 2014 14:55:27 GMT https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-install-a-Splunk-forwarder-on-centralized/m-p/188957#M37668 jwalzerpitt 2014-10-31T14:55:27Z https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-install-a-Splunk-forwarder-on-centralized/m-p/188958#M37669 <P>Thx for the reply and info.</P> <P>At some point I hope they migrate the filtering function onto the Indexer so one can start by indexing everything at first, and then allow the user the ability to go in and start selecting events to be excluded. Not sure how this would effect scalability/performance of the indexer though if it was implemented as such. </P> Fri, 31 Oct 2014 14:58:01 GMT https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-install-a-Splunk-forwarder-on-centralized/m-p/188958#M37669 jwalzerpitt 2014-10-31T14:58:01Z https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-install-a-Splunk-forwarder-on-centralized/m-p/188959#M37670 <P>For filtering events based on field values you should take a look at the TRANSFORMS-foo entries in props.conf together with transforms.conf. Here's an example: <A href="http://docs.splunk.com/Documentation/Splunk/6.2.0/Forwarding/Routeandfilterdatad">http://docs.splunk.com/Documentation/Splunk/6.2.0/Forwarding/Routeandfilterdatad</A></P> <P>That can be done on a Heavy Forwarder xor an Indexer.</P> Fri, 31 Oct 2014 14:59:18 GMT https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-install-a-Splunk-forwarder-on-centralized/m-p/188959#M37670 martin_mueller 2014-10-31T14:59:18Z https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-install-a-Splunk-forwarder-on-centralized/m-p/188960#M37671 <P>That's there already, it's called "searching" <span class="lia-unicode-emoji" title=":face_with_tongue:">😛</span></P> Fri, 31 Oct 2014 15:00:20 GMT https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-install-a-Splunk-forwarder-on-centralized/m-p/188960#M37671 martin_mueller 2014-10-31T15:00:20Z https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-install-a-Splunk-forwarder-on-centralized/m-p/188961#M37672 <P>Awesome - thx Martin!</P> Fri, 31 Oct 2014 15:01:13 GMT https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-install-a-Splunk-forwarder-on-centralized/m-p/188961#M37672 jwalzerpitt 2014-10-31T15:01:13Z https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-install-a-Splunk-forwarder-on-centralized/m-p/188962#M37673 <P>How true! My fears are two-fold: 1) I'm indexing data that's not needed to shine light upon connections/patterns/etc and 2) I'd be excluding events/field values that I think aren't important, but actually are</P> <P>Considering using Hadoop on the backend to send all data to and then Hunk to search against the entire data set, but int he meantime re: using Splunk for real-time, proactive alerting I'd like to index only those relevant events/field values </P> Fri, 31 Oct 2014 15:04:30 GMT https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-install-a-Splunk-forwarder-on-centralized/m-p/188962#M37673 jwalzerpitt 2014-10-31T15:04:30Z https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-install-a-Splunk-forwarder-on-centralized/m-p/188963#M37674 <P>Martin,</P> <P>I wanted to expand on this question to pick your brain a little more and run through a scenario. We are planning to consume firewall syslog and we log at debugging level, which as you know, is very chatty. With that, if we have the indexer set as a listener, can we filter using transforms on the indexer, or would the firewall syslog need to go to a forwarder first to have events filtered before the data is indexed?</P> <P>Thx</P> Fri, 07 Nov 2014 14:52:39 GMT https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-install-a-Splunk-forwarder-on-centralized/m-p/188963#M37674 jwalzerpitt 2014-11-07T14:52:39Z